The export named configuration snapshot operation is the most operationally efficient method to achieve the stated goal. This function, located under Device > Setup > Operations, allows the administrator to select a specific configuration version, including the live running-config.xml, and download it directly to an external location (the administrator's computer). This single action precisely fulfills the requirement of backing up only the running configuration externally before a maintenance window.

A. save named configuration snapshot: This action saves a copy of the running configuration as a snapshot file on the firewall's local disk, not to an external location.

B. export device state: This exports a comprehensive bundle that includes logs, licenses, and other system information, not only the running configuration as specified in the question.

D. save candidate config: This saves the candidate configuration (changes that have not been committed), not the active running configuration, and it saves the file locally on the firewall.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Manage Configuration Backups".

Section: Device > Setup > Operations

Content: The guide details the functions available under this menu. It specifies that Export Named Configuration Snapshot is used to "Export a configuration snapshot from the firewall to your local computer." It also clarifies that the running-config.xml is an available snapshot to export. This directly supports option C. The guide also confirms that Save Named Configuration Snapshot and Save Candidate Config save files locally on the firewall

and Export device state includes more than just the configuration file.

2. Palo Alto Networks PAN-OS® Administrator’s Guide 11.0

"Revert to a Previous Configuration Version".

Section: Save and Export Configuration Snapshots

Content: "To save a configuration snapshot to a location outside of the firewall

you must export it... Select Device > Setup > Operations and

in the Configuration Management section

click Export Named Configuration Snapshot." This explicitly states that exporting is the method for saving a configuration to an external location.