PCNSA Device Management and Services Practice Question
A company runs a pair of PA-5250 firewalls in active/passive HA controlling the production data center (10 Gbps traffic). The security team needs to upgrade from PAN-OS 10.0 to 10.2 to fix several critical CVEs. The team has a maintenance window of four hours. The lead engineer suggests performing the upgrade in the following order: 1. Download and install the upgrade on the passive firewall, 2. Commit after install, 3. Perform a non-disruptive failover to make the passive active, 4. Upgrade the new passive (former active), 5. Fail back to the original active. A junior engineer points out that the passive firewall takes 30 minutes to boot and join the HA pair after upgrade. The maintenance window is only four hours. What should the team do to ensure the upgrade completes within the window?
⚠ Common exam trap
A common mix-up: candidates assume the download step is negligible or can be performed during the window, but they fail to account for the cumulative time of downloads, reboots, and HA synchronization, which can easily exceed a four-hour window without pre-staging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pre-stage the software download on both firewalls before the maintenance window begins.
Pre-staging the software download on both firewalls before the maintenance window eliminates the time required for the download step, which can be significant over a WAN or slow management connection. This allows the team to focus the four-hour window solely on the installation, reboot, and HA synchronization steps, which are the time-critical components. Since the passive firewall takes 30 minutes to boot and join the HA pair, pre-staging ensures the download (which could take 30–60 minutes or more) does not consume valuable window time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Upgrade both firewalls simultaneously during the window to save time.
Why it's wrong here
Simultaneous upgrade risks both firewalls being down.
- ✗
Use the 'request high-availability sync-to-remote' command to speed up the upgrade.
Why it's wrong here
That command syncs configuration, not software.
- ✓
Pre-stage the software download on both firewalls before the maintenance window begins.
Why this is correct
Pre-staging download saves significant time.
- ✗
Perform the upgrade as planned, but skip the final fail-back to save 15 minutes.
Why it's wrong here
Skipping fail-back saves minimal time and may not be sufficient.
Go deeper
Related to this question
About these practice questions
One of 516 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.