- The Exam at a Glance
- Blueprint and Domain Weights
- Domain 1: PAN-OS Networking Configuration
- Domain 2: PAN-OS Device Setting Configuration
- Domain 3: Integration and Automation
- Scoring and Question Format Facts
- Fees, Registration and Test-Day Rules
- Retakes, Validity and Renewal
- Who the Exam Targets
- Scheduling Your Review by Domain
- Frequently Asked Questions
- Domains 1 and 2 (PAN-OS Networking and Device Setting Configuration) are each 40%; Integration and Automation is 20%.
- The passing score is 860 on a 300-1000 scale, not an 86% raw requirement.
- Registration costs USD 250 plus applicable taxes and fees, with no published member/non-member pricing split.
- New appointments are in-person only at Pearson VUE test centers since August 1, 2025.
The Exam at a Glance
The Palo Alto Networks Certified Next-Generation Firewall (NGFW) Engineer is a Specialist-level credential in the Network Security track. It targets practitioners who configure, tune and integrate PAN-OS firewalls rather than people who only read about them. This page condenses the verified facts into one scannable review. If you want the deeper reasoning behind each item, the NGFW-Engineer study guide walks through a full preparation plan.
| Item | Verified fact |
|---|---|
| Issuer | Palo Alto Networks |
| Level and track | Specialist, Network Security track |
| Testing provider | Pearson VUE |
| Registration fee | USD 250 plus applicable taxes/fees |
| Passing score | 860 on a 300-1000 scale |
| Delivery | English; in-person for new appointments |
| Validity | Two years |
| Mandatory prerequisite | None |
Blueprint and Domain Weights
The exam blueprint has exactly three domains. Two of them are tied at 40%, which means the exam is heavily weighted toward hands-on PAN-OS configuration knowledge rather than scripting or API trivia.
| Domain | Weight |
|---|---|
| Domain 1: PAN-OS Networking Configuration | 40% |
| Domain 2: PAN-OS Device Setting Configuration | 40% |
| Domain 3: Integration and Automation | 20% |
Treat these as proportions of exam coverage, not as exact item counts. The issuer does not publish a per-domain question tally, and you should not assume that 40% maps to a specific number of questions. For a topic-by-topic breakdown, see the complete guide to all three content areas.
Domain 1: PAN-OS Networking Configuration (40%)
This domain covers how traffic enters, moves through and leaves the firewall. Candidates are expected to configure and reason about the network plumbing of PAN-OS, not just memorize menu paths.
Domain 1: PAN-OS Networking Configuration
Think in terms of the packet path: interfaces, zones, virtual routers and the policy decisions that sit on top of them.
- Interface types and deployment modes, and how each changes what the firewall can see and control
- Security zones and how zone assignment drives policy matching
- Virtual routers, static and dynamic routing, and route-selection behavior
- NAT configuration and how NAT interacts with security policy evaluation
- High availability pairs: what is synchronized, what triggers failover, and how to verify state
- VPN and tunnel configuration, including how tunnel interfaces fit into zones and routing
Habits that pay off in this domain
- Trace a packet end to end: ingress interface, zone, route lookup, NAT, policy, egress. Many scenario questions reward this mental model.
- Practice distinguishing pre-NAT versus post-NAT addressing when reading policy scenarios.
- Know how to verify a configuration from the CLI and from the web interface, since troubleshooting-flavored questions often assume you can interpret what a verification view is telling you.
Domain 2: PAN-OS Device Setting Configuration (40%)
This domain is about the firewall as a managed device: how it is administered, how it authenticates users and admins, how it logs, and how it is kept healthy. It carries the same 40% weight as networking, so under-preparing here is one of the most common ways to lose ground.
Domain 2: PAN-OS Device Setting Configuration
Focus on the operational and administrative layer that makes a firewall deployable in a real environment.
- Management interface configuration and administrative access controls
- Administrator authentication, role-based access and authentication profiles
- Certificate management, including how certificates support decryption, management access and VPNs
- Logging, log forwarding and the profiles that determine where log data goes
- Software and content updates, and the commit and validation workflow
- Configuration backup, export, rollback and the difference between candidate and running configuration
Key Takeaway
Domains 1 and 2 together are 80% of the blueprint. A candidate who is strong on routing and NAT but shaky on certificates, authentication and logging is leaving a large share of the exam exposed.
If you are judging whether your background is enough, the article on how hard the NGFW-Engineer exam is explains where candidates typically feel the gap.
Domain 3: Integration and Automation (20%)
The smallest domain still deserves deliberate study, because it is the one most administrators have touched least. The issuer's recommended background includes networking and scripting knowledge, which signals that automation is a genuine part of the role rather than an afterthought.
Domain 3: Integration and Automation
Understand how PAN-OS exchanges information with other systems and how repetitive work gets automated.
- The PAN-OS APIs and how programmatic changes are made, committed and verified
- Dynamic objects and tag-based mechanisms that let policy respond to changing inventory
- Integration with external identity, logging and orchestration systems
- Template and configuration-reuse concepts that reduce manual drift across many devices
- Reading and reasoning about simple scripts or API calls rather than writing large programs from scratch
Because this domain is 20%, it is a cost-effective area to close gaps in: modest, focused effort here can protect you from losing points on questions that other candidates skip over.
Scoring and Question Format Facts
The passing score
The Palo Alto Networks Certification Handbook publishes a passing score of 860 on a 300-1000 scale for all certification exams. That is a scaled score, not an 86% raw percentage, and you should not try to convert it into a number of questions you can miss. For a fuller explanation, read the NGFW-Engineer passing score breakdown.
Format and what is not published
- Pearson VUE describes the delivery as computer-based, with multiple-choice, matching and ordering question styles.
- The exact item mix for this specific exam, the current question count and the base duration were not verified, and the public datasheet does not publish them. Do not trust any figure you see quoted without a primary source.
- The scored versus unscored split is undisclosed. Unidentified pretest items may appear, and they do not affect your score.
- No exam-specific calculator and no adaptive-testing behavior has been verified.
- Delivery is in English, with a default 30-minute ESL extension in non-English-speaking countries.
On the question of how many candidates succeed, be cautious: the pass rate discussion explains why published pass-rate claims should be treated skeptically when the issuer does not release them.
Fees, Registration and Test-Day Rules
Cost
The Specialist registration fee is USD 250 plus applicable taxes and fees. No member versus non-member price distinction is published, and the figure is confirmed in the Certification Program FAQ and in Pearson's USD voucher store. The full cost picture, including what you may or may not pay beyond the exam, is covered in the NGFW-Engineer certification cost breakdown.
Where and how you test
- Under the issuer announcement dated June 30, 2025 and effective August 1, 2025, new appointments are in-person only.
- Some residual Pearson OnVUE links may still appear online. Do not rely on them for new bookings.
- Cancellation or rescheduling requires at least 48 hours of notice.
- Results are provisional pending review.
What you may not bring
Personal books, notes and other unauthorized materials are prohibited under the Candidate Agreement. Read it before test day rather than assuming the rules match another vendor's exam. Scheduling windows and deadlines are discussed further in the exam dates and scheduling guide.
Retakes, Validity and Renewal
| Topic | Rule |
|---|---|
| Failed-attempt waits | 15 days, then 30 days, then 90 days |
| Credential validity | Two years |
| Renewal method | Re-take the exam before expiry |
| Same-exam eligibility for renewal | After 18 months (545 days) |
| Higher-level credential effect | A higher-level credential in the same track also renews active lower-level credentials (September 2026 policy) |
| CPE/CEU quota | None published |
Key Takeaway
Because the waits escalate to 90 days after repeated failures, treat your first attempt as a real attempt. Book only when your practice results are consistently comfortable across both 40% domains, not when you merely feel close.
Who the Exam Targets
There is no mandatory prior credential, no required degree and no published references requirement. The issuer instead recommends roughly two to three years in IT security and about two years working with its NGFW solutions, plus relevant networking and scripting knowledge. The recommended Network Security Professional or Analyst certifications and training are suggestions, not required credentials or hour quotas. The eligibility and prerequisites article covers how to judge whether you qualify in practice.
Employers and roles
The skills here map onto roles that deploy and operate PAN-OS firewalls: network security engineers, firewall administrators, security operations engineers and integrators or managed-service teams who manage customer firewalls. No exclusive PAN-OS release and no certification-specific salary premium was verified, so avoid claims that this credential guarantees a pay bump. For market context, see the NGFW-Engineer jobs overview, and for compensation discussion without invented numbers, the salary guide. If you are weighing the investment, the ROI analysis frames the decision.
Scheduling Your Review by Domain
A simple domain-driven schedule works better than studying topics in whatever order they appear in a book. Because Domains 1 and 2 are each 40%, they should absorb most of your calendar, with Domain 3 as a focused closing block.
Domain 1: Networking
- Build and break interface, zone, routing and NAT labs
- Practice tracing packets and verifying state from the CLI
- Rehearse HA and VPN behavior until you can predict outcomes
Domain 2: Device Settings
- Work through authentication, administration roles and certificates
- Configure logging and log forwarding end to end
- Drill commit, rollback and configuration management workflows
Domain 3: Integration and Automation
- Make API calls and read their responses
- Experiment with dynamic objects and tag-driven policy
Mixed review
- Take timed mixed-domain practice sets on the main practice test site
- Re-study only the areas where you still miss questions
Adjust the length to your experience. Someone who administers PAN-OS daily may compress the early weeks, while someone coming from another vendor should expand them. When you are ready for exam-style repetition, use the NGFW-Engineer Exam Prep practice questions to find weak spots across all three domains.
Frequently Asked Questions
The Palo Alto Networks Certification Handbook publishes a passing score of 860 on a 300-1000 scale for all of its certification exams. It is a scaled score, not an 86% raw requirement.
The Specialist registration fee is USD 250 plus applicable taxes and fees. No separate member or non-member price is published.
New appointments are in-person only under the issuer announcement effective August 1, 2025, even if some older OnVUE links still appear on Pearson pages. Confirm the current option when you book.
The current public datasheet does not publish an exact question count or timer, and those details were not verified. Expect computer-based multiple-choice, matching and ordering styles, and check Pearson VUE when you schedule.
It is valid for two years. You renew by taking the exam again before expiry, with same-exam eligibility opening after 18 months (545 days). A higher-level credential in the same track also renews active lower-level credentials, and no CPE/CEU quota is published.