An administrator needs to ensure that a firewall can download threat prevention and software updates,...

Basic Concept: Service routes can move firewall-originated Palo Alto Networks service traffic from the management port to a data-plane interface when the management network lacks Internet access.

Why C is Correct: Palo Alto Networks Services must be rerouted so the firewall can reach update and support services through the data-plane path.

Why A is Wrong: External dynamic lists are downloaded objects that can be used in policy. They are not the Palo Alto Networks update service used for threat prevention and software downloads.

Why B is Wrong: GlobalProtect Clientless VPN provides browser-based access to internal applications. It is unrelated to downloading PAN-OS software or content updates.

Why D is Wrong: Syslog is used to forward logs to external collectors. Rerouting syslog would not allow the firewall to reach Palo Alto Networks update services.