Prisma Cloud Defenders are designed for high availability and autonomous operation. If a Defender loses its connection to the Console (e.g., during a Console upgrade or network outage), it continues to function using the last policy configuration it received. It will keep enforcing all security rules and collecting alert data locally. Once the connection is re-established, the Defender forwards all buffered data to the Console.

A. Defenders continue to both alert and enforce policy. Disabling enforcement would create a significant security gap during a management plane outage.

B. "Fail closed" is not the default behavior, as it would block all application traffic and cause a service outage, which is too disruptive for most environments.

C. "Fail open" is not the behavior, as it would mean disabling all security protections, which contradicts the purpose of the Defender.

1. Palo Alto Networks

"Prisma Cloud Compute Administrator's Guide (Self-Hosted)"

Version Darwin. Section: "System Architecture > Defender". The guide states

"If a Defender is disconnected from the Console

it continues to enforce the last-known policy. When the connection is re-established

the Defender sends all of its buffered data to the Console."