Palo Alto Networks Certified Network Security Administrator (PCNSA)Initial Configuration and ManagementMedium
A network administrator needs to update the PAN-OS software on a Palo Alto Networks firewall. Before initiating the upgrade, which critical step must be performed to ensure a rollback option is available in case of unforeseen issues?
- ARestart the management server process to clear its cache.
- BDisable all security policies to prevent traffic disruption.
- CCommit the running configuration to non-volatile memory.
- DCreate a configuration backup and export it off the device.
Show answer & explanationAnswer & explanation
Correct answer: D. Create a configuration backup and export it off the device.
Before any major software upgrade, it is crucial to create a configuration backup and export it off the device. This ensures that if the upgrade fails or causes unexpected problems, a known good configuration can be restored to the firewall.
Why the other options are wrong
- A. Restarting the management server is not a standard pre-upgrade step and doesn't provide a rollback mechanism for the OS or configuration.
- B. Disabling security policies is not a standard pre-upgrade step and could expose the network.
- C. Committing the configuration saves the current running config, but it doesn't provide an easy rollback to a previous state if the upgrade itself corrupts the device or the new OS.
PAN-OS Upgrade Best Practice
Always back up the firewall configuration before a PAN-OS upgrade to enable rollback and disaster recovery.
- Export configuration to an external location.
- Allows restoration to a known working state.
- Prevents data loss during upgrade failures.
Memory trick: Before you jump to the new OS, back up your config, lest you lose!