A firewall engineer needs to update a company's Panorama-managed firewalls to the latest version of PAN-OS. Strict security requirements are blocking internet access to Panorama and to the firewalls. The PAN-OS images have previously been downloaded to a secure host on the network. Which path should the engineer follow to deploy the PAN-OS images to the firewalls?

In a Panorama-managed environment where direct internet access is unavailable, the PAN-OS software image must first be manually uploaded to Panorama from a local host. The correct administrative path in the Panorama web interface to manage and deploy operating system software to managed firewalls is Panorama > Device Deployment > Software. From this section, an administrator can upload the pre-downloaded image file and then push it to the designated firewalls for installation. This process centralizes the upgrade for all managed devices without requiring them to have individual internet connectivity.

A: The Panorama > Software menu is used for managing and upgrading the PAN-OS software for the Panorama appliance itself, not for the managed firewalls. B: The Dynamic Updates menu is for deploying content updates, such as application and threat signatures or antivirus definitions, not for PAN-OS system software images. C: The Panorama > Dynamic Updates menu is incorrect for the same reason as option B; it is designated for content files, not the core operating system.

1. Palo Alto Networks Panorama Administrator's Guide 10.2: In the section "Install a PAN-OS Software Release," the procedure for an offline environment is detailed. It states, "If Panorama does not have internet access, you must first download the software release from the Palo Alto Networks Customer Support Portal to your client system. Then, in Panorama, select Panorama > Device Deployment > Software and Upload the software to Panorama." This directly confirms the path in option D.

2. Palo Alto Networks Panorama Administrator's Guide 10.2: The section "Manage Software Upgrades for Firewalls" further clarifies the process: "Use Panorama to centrally manage software upgrades for the firewalls it manages... The workflow begins with retrieving the software from the Palo Alto Networks update server or by uploading it to Panorama. Then you can install the software on one or more firewalls." This distinguishes the Device Deployment > Software section's purpose from other menus.

3. Palo Alto Networks Panorama Administrator's Guide 10.2: The section "Manage Content and Software Updates for Panorama" describes the process for updating Panorama itself, which uses the Panorama > Software path, confirming why option A is incorrect as it applies to Panorama, not the managed firewalls.