Palo Alto Networks Certified Next-Generation Firewall Engineer credential artwork

Palo Alto Networks Certified Next-Generation Firewall Engineer (NGFW Engineer) (NGFW-Engineer) Exam Guide

Validates practical skills in configuring Palo Alto Networks firewalls, including PAN-OS networking, device settings, Panorama and deployment automation.

The exam tests whether you can configure and run Palo Alto firewalls: interfaces, zones, routing, HA and GlobalProtect; authentication, virtual systems, logging, certificates, decryption and User-ID; and deploying and managing firewalls with Panorama, APIs and cloud tooling. Prepare with hands-on lab time against the datasheet, not just videos.

Understand the exam

Syllabus

1PAN-OS networking configuration40%
  1. 1.1Configure interface
  2. 1.2Configure zones
  3. 1.3Configure high availability (HA)
  4. 1.4Configure routing
  5. 1.5Configure GlobalProtect
  6. 1.6Configure tunnels

Example scenario: A branch needs a site-to-site tunnel to headquarters plus failover to a second ISP. Which interfaces, zones, tunnel settings and monitoring would you configure?

2PAN-OS device setting configuration40%
  1. 2.1Implement authentication roles, profiles, and sequences
  2. 2.2Configure virtual systems (VSYS)
  3. 2.3Configure logging
  4. 2.4Implement PAN-OS software updates
  5. 2.5Configure certificates
  6. 2.6Configure on-premises and Cloud Identity Engine User-ID
  7. 2.7Configure web proxy on PAN-OS

Example scenario: Security wants outbound HTTPS decryption, but some finance sites must be exempt. Which certificates, profiles and policies are involved?

3Integration and automation20%
  1. 3.1Install the selected deployment option
  2. 3.2Use APIs to automate deployment
  3. 3.3Manage third-party services to deploy NGFWs
  4. 3.4Use on-premises centralized management
  5. 3.5Build Application Command Center (ACC) dashboards and custom reports

Example scenario: You need to roll out a common rule set to 40 branch firewalls but allow local exceptions. How would you structure device groups and rule order in Panorama?

NGFW Engineer datasheet · November 2025 blueprint

Format

Duration
90 min
Passing score
860 / 1000
Delivery
Test centre
Languages
English

Question types

Choose the single best answer.

CertUp example

Users report that a newly allowed web application is still blocked. Traffic logs show the session hitting the intended rule with action allow. What is the most likely cause?

  1. A security profile on the rule is blocking a threat
  2. The NAT rule is missing
  3. The zone protection profile is disabled
  4. The management interface is down
Show answer

A. The rule allows the session, but an attached security profile (for example URL filtering or vulnerability protection) can still block it.

Eligibility and booking

Buy a voucher, then book a Pearson VUE test centre appointment. Use your legal name as it appears on your government ID.

Buy an exam voucherSchedule with Pearson VUE

Make a study plan

Rate yourself against the datasheet tasks first. Plan lab time for any feature you have not configured yourself.

Most candidates spend 40–80 hours. Plan for the low end if you manage Palo Alto firewalls at work; add time and lab practice for Panorama, cloud deployments and automation if they are new to you.

7 weeksto be ready
  1. 1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.3 h
  2. 3Learn the core conceptsWork through one main course or book, topic by topic.29 h
  3. 4Practice with mock examsTake timed practice tests and review every mistake.15 h
  4. 5Prepare for exam dayBook the exam and check the ID and delivery rules.3 h

Learn the core concepts

Start with Palo Alto’s free learning path. Add the five-day EDU-210 course if your employer is paying, and lab every task you have not done at work.

Best free coursePalo Alto Networks Beacon learningPalo Alto Networks · Free · account requiredBest for employer-fundedEDU-210 Firewall Essentials: Configuration and ManagementPalo Alto Networks · Training credits or a quote from an authorized training partner
See all 2 NGFW Engineer courses →

Fill the automation gap. Candidates found the free learning path light on deployment options and automation. Use product documentation and a lab for those tasks.

Practice with mock exams

Practice questions help you find gaps, but configuration practice matters more. When you miss a question, configure the feature it covered.

NGFW Engineer Practice TestsSecurityPracticeTest.com · Free 20-question sets · $33 for ten 60-question tests
See all 1 NGFW Engineer practice tests →

Are you ready?

  • You have configured every datasheet task at least once in a lab or at work.
  • You can explain how Panorama templates, device groups and rule order interact.
  • You can deploy a VM-Series or Cloud NGFW instance and automate a basic change through the API.

Prepare for exam day

NGFW Engineer is taken at a Pearson VUE test centre.

  • Bring government-issued ID that matches the legal name on your Pearson VUE profile.
  • Cancel or reschedule at least 48 hours ahead, or you lose the exam fee.
  • The appointment time includes accepting the candidate agreement before the exam starts.
  • Pace yourself at a little over a minute per question.
  • If you fail, wait 15 days before a second attempt, 30 before a third and 90 before any later attempt.

Palo Alto Networks certification handbook

Advice from exam takers