A customer has a large environment that needs to upgrade Console without upgrading all Defenders at one time. What are two prerequisites prior to performing a rolling upgrade of Defenders? (Choose two.)

Performing a rolling upgrade of Prisma Cloud Defenders requires specific conditions to ensure compatibility and functionality. First, the Console must be upgraded to version 'n' before the Defenders. The new Console (version n) is designed to be backward compatible, managing Defenders from the previous version (n-1). This allows Defenders to be upgraded gradually. Second, the upgrade process for Defenders utilizes the twistcli command-line tool. It is a prerequisite to download the new release package, which contains the version of twistcli corresponding to the new Defender version, to generate the correct deployment manifests.

B. Defenders must remain active to communicate with the Console and enforce policy. Setting them to read-only mode is not a documented step and would disrupt their function.
C. A second location for the Console pertains to a blue-green deployment strategy for the Console itself, not a rolling upgrade of its distributed Defenders.
D. A software version upgrade does not inherently require additional licenses unless the number of protected nodes or workloads is also being increased.

1. Palo Alto Networks, Prisma Cloud Self-Hosted Administrator's Guide, "Upgrade Console and Defenders". The guide states, "Prisma Cloud supports backward compatibility, where a new Console can manage Defenders from the previous release (n-1)." This confirms the n-1 prerequisite.

2. Palo Alto Networks, Prisma Cloud Self-Hosted Administrator's Guide, "Upgrade Defenders". The upgrade procedure details downloading the new software tarball and using the enclosed twistcli to deploy the new Defenders, establishing this as a required step.