When planning an upgrade in an environment that includes Panorama, firewalls, and log collectors, it's crucial to follow the recommended sequence to ensure compatibility and minimize disruptions. Palo Alto Networks recommends the following order:
Upgrade Panorama: Start with Panorama because it's the central management platform. Upgrading Panorama first ensures that it's compatible with the new PAN-OS versions that the managed devices (firewalls and log collectors) will be upgraded to. Panorama must be able to support the new versions for it to manage and monitor the devices effectively.
Upgrade the log collectors: Next, upgrade the log collectors. Since log collectors work closely with Panorama to aggregate and store logs from the firewalls, they should be upgraded after Panorama to ensure compatibility. Upgrading the log collectors ensures they can handle the log formats and features introduced in the new PAN-OS version.
Upgrade the firewalls: Finally, upgrade the firewalls. The firewalls are the last components to be upgraded to ensure that they remain compatible with the management and log collection infrastructure. Upgrading the firewalls last minimizes the risk of compatibility issues with Panorama and log collectors.
This sequence ensures that all components are compatible and that the management and logging infrastructure can fully support the firewalls running the latest PAN-OS version.

The correct packet-flow sequence is C. PBF > Static route > Security policy enforcement. This sequence describes the order of operations that the firewall performs when processing a packet. PBF stands for Policy-Based Forwarding, which is a feature that allows the firewall to override the routing table and forward traffic based on the source and destination addresses, application, user, or service. PBF is evaluated before the static route lookup, which is the default method of forwarding traffic based on the destination address and the longest prefix match. Security policy enforcement is the stage where the firewall applies the security policy rules to allow or block traffic based on various criteria, such as zone, address, port, user, application, etc12. Reference: Policy-Based Forwarding, Packet Flow Sequence in PAN-OS

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/policies/policies-application-override
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPDrCAO