Which two options may be used to upgrade the Defenders with a Console v20.04 and Kubernetes deployment? (Choose two.)

In a Kubernetes environment managed by Prisma Cloud Compute, Defenders have two primary upgrade paths. The default and most common method is automatic upgrade. When the Console is upgraded, deployed Defenders will detect the version mismatch on their next check-in, download the new image, and restart themselves to complete the upgrade. Alternatively, for more granular control, an administrator can perform a manual upgrade. This involves deleting the existing Defender DaemonSet from the cluster (kubectl delete -f defender.yaml) and then deploying the new DaemonSet manifest provided by the upgraded Console.

A. Run the provided curl | bash script from Console to remove Defenders, and then use Cloud Discovery to automatically redeploy Defenders: The curl script is for installation, not removal, and Cloud Discovery only identifies unprotected hosts, it does not deploy Defenders.

B. Remove Defenders DaemonSet, and then use Cloud Discovery to automatically redeploy the Defenders: Cloud Discovery is not a deployment mechanism; it is used for visibility and identifying where protection is needed.

1. Palo Alto Networks

Prisma Cloud Compute Administrator's Guide. "Upgrade Prisma Cloud". The section on "Upgrading Defenders" explicitly states

"By default

Defenders automatically upgrade themselves after Console is upgraded."

2. Palo Alto Networks

Prisma Cloud Compute Administrator's Guide. "Deploy Defenders". The guide details the manual deployment process using the DaemonSet YAML file. The manual upgrade process is the reverse (delete old DaemonSet) followed by this deployment process with the new file. This confirms the validity of the manual redeployment option.