- The Published Blueprint at a Glance
- Domain 1: PAN-OS Networking Configuration (40%)
- Domain 2: PAN-OS Device Setting Configuration (40%)
- Domain 3: Integration and Automation (20%)
- Weights, Proportions, and the 24% Conflict
- How the Exam Is Delivered and Scored
- Sequencing Your Prep Around the Weights
- Who This Credential Fits
- Frequently Asked Questions
- The NGFW-Engineer blueprint has exactly three domains: Networking Configuration (40%), Device Setting Configuration (40%), and Integration and Automation (20%).
- Networking and Device Settings are tied, so together they make up 80% of the published blueprint.
- Passing requires a scaled score of 860 on a 300-1000 scale, not an 86% raw percentage.
- The November 2025 datasheet puts Integration and Automation at 20%; an older community blog's 24% figure is superseded.
The Published Blueprint at a Glance
The Palo Alto Networks Certified Next-Generation Firewall (NGFW) Engineer is a Specialist-level credential in the Network Security track. Its content scope comes straight from the Next-Generation Firewall Engineer Datasheet (November 2025), which publishes three exam-objective domains. This guide walks through each one, explains what the weighting means for your preparation, and clears up a conflicting figure that still circulates online.
One caution up front: the weights describe proportion of the blueprint, not a fixed number of questions. The issuer does not publish an exact item count per domain, so treat the percentages as a guide to where your study hours should go rather than a quota to count against.
| Domain | Weight | Core Theme |
|---|---|---|
| Domain 1: PAN-OS Networking Configuration | 40% | Building and tuning the traffic-handling layer of the firewall |
| Domain 2: PAN-OS Device Setting Configuration | 40% | Configuring the platform itself: administration, system services, and operational settings |
| Domain 3: Integration and Automation | 20% | Connecting the firewall to other systems and driving it programmatically |
If you want the broader context before diving into domains, the overview of what the NGFW-Engineer certification is covers how the credential fits into the Palo Alto Networks program.
Domain 1: PAN-OS Networking Configuration (40%)
This domain is tied for the heaviest on the blueprint, and for good reason: a next-generation firewall is first a network device. Every security policy you write depends on traffic arriving on the right interface, in the right zone, along the right path. Candidates who treat networking as background knowledge tend to struggle here, because the exam expects you to configure and reason about PAN-OS behavior, not just recite networking theory.
What Candidates Should Be Able to Do
Think in terms of the packet's journey through the firewall. The exam rewards candidates who can trace why a flow succeeds, fails, or takes an unexpected path.
- Configure interfaces and assign them to security zones in the appropriate deployment mode
- Build and troubleshoot routing, including how the firewall chooses a path when multiple options exist
- Work with virtual routers and understand how traffic moves between them
- Configure address translation and reason about how NAT interacts with security policy
- Understand Layer 2 and Layer 3 behaviors, VLANs, and subinterfaces
- Configure VPN connectivity and know where it fits in the overall flow
Why This Domain Trips People Up
The most common failure pattern is knowing individual features but not their interactions. For example, a NAT rule and a security rule can both look correct in isolation while the combined behavior is wrong, because policy is evaluated against zones and addresses at specific points in the flow. Practicing end-to-end scenarios, rather than memorizing feature lists, pays off disproportionately in this domain.
For a sense of how demanding the whole exam is relative to your background, see our breakdown of how hard the NGFW-Engineer exam is.
Domain 2: PAN-OS Device Setting Configuration (40%)
The second 40% domain covers the platform-level configuration that makes a firewall deployable and supportable in production. Where Domain 1 is about traffic, Domain 2 is about the device: who can administer it, how it communicates with infrastructure services, how it is managed, and how its configuration is controlled over time.
Typical Device-Level Competencies
Expect questions that ask what you would configure, where, and why, drawn from the day-to-day work of running a PAN-OS deployment.
- Administrative access and role-based control of who can do what on the device
- Management interface and service-route behavior, including how the firewall reaches external services
- Authentication integration for administrators and users
- Certificate handling and the settings that depend on it
- Logging, log forwarding, and operational visibility
- Configuration management: commits, candidate versus running configuration, and rollback behavior
- High availability and device-level resilience settings
The Operational Mindset
Domain 2 questions often read like situations an engineer faces after the initial deployment: a service cannot reach an external server, a commit behaves unexpectedly, an administrator has the wrong level of access. The skill being tested is diagnosing and configuring the device, not memorizing menu paths. Candidates with real operational experience typically find this domain more intuitive than those who have only studied the product.
Key Takeaway
Do not underestimate Domain 2 because it feels less exciting than routing and NAT. It carries the same 40% weight as Networking, so a shaky grasp of device settings can sink an otherwise strong attempt.
Domain 3: Integration and Automation (20%)
The smallest domain is also the one where candidates most often under-prepare, precisely because it is the smallest. At 20%, it is still a fifth of the blueprint. The issuer recommends relevant networking and scripting knowledge for this credential, and this domain is where that scripting recommendation becomes tangible.
Integration and Automation Themes
This domain is about the firewall as a participant in a larger ecosystem rather than a standalone box.
- Programmatic interaction with PAN-OS, including API-driven configuration and retrieval
- Automating repetitive operational tasks instead of repeating manual steps
- Integrating the firewall with external systems that supply or consume security information
- Understanding how automation interacts with commits and configuration state
- Reading and reasoning about simple scripts and structured data
Building the Skill Without Being a Developer
You do not need to be a software engineer, but you should be comfortable reading a short script, understanding structured request and response data, and knowing what an API call against the firewall is trying to accomplish. Even modest hands-on practice, such as retrieving configuration or making a small change through the API, builds the familiarity that makes these questions approachable.
Weights, Proportions, and the 24% Conflict
If you have researched this exam for more than a few minutes, you may have seen Integration and Automation quoted at 24%. That figure comes from a June 2025 community blog post. The currently linked formal blueprint, the November 2025 datasheet, lists it at 20%, and the formal blueprint is the controlling source. Plan against 20%.
Two practical implications follow from the weights. First, 80% of the blueprint sits in the two 40% domains, so a plan that spreads effort evenly across all three domains is misallocated. Second, because the weights are proportions rather than item counts, you cannot infer how many questions any domain will contribute. For a full approach to building a plan around these numbers, see the NGFW-Engineer study guide.
How the Exam Is Delivered and Scored
Format and Provider
The exam is delivered through Pearson VUE as a computer-based test. The provider's page describes question types that include multiple-choice, matching, and ordering. The exact mix of question types for this specific exam, the current question count, and the base duration have not been verified from published sources, so avoid relying on any figures you find elsewhere. The datasheet does not publish an exact question count or timer.
Some questions on any given exam may be unscored pretest items. The issuer does not disclose the scored/unscored split, and unidentified pretest items do not affect your result, so there is no benefit to trying to guess which ones they are. Answer everything with equal care.
Scoring
The Palo Alto Networks Certification Handbook publishes a passing score of 860 on a 300-1000 scale for all certification exams. This is a scaled score, not an 86% raw requirement, so you cannot convert it into a simple count of correct answers. Our article on the NGFW-Engineer passing score goes deeper on what scaled scoring means in practice.
Fee, Scheduling, and Test-Day Rules
| Item | What the Published Sources Say |
|---|---|
| Registration fee | USD 250 plus applicable taxes and fees; no published member/non-member distinction |
| Delivery | New appointments in-person only (issuer announcement effective August 1, 2025), despite residual online-proctoring links |
| Language | English, with a default 30-minute ESL extension in non-English-speaking countries |
| Cancel/reschedule | Requires 48 hours' notice |
| Retake waits | 15 days, then 30 days, then 90 days after failed attempts |
| Results | Provisional pending review |
| Materials | Personal books, notes, and unauthorized materials prohibited under the Candidate Agreement |
For the full financial picture, including how fees accumulate across retakes, read the NGFW-Engineer certification cost breakdown. Scheduling specifics are covered in the guide to NGFW-Engineer exam dates and scheduling.
Validity and Renewal
The credential is valid for two years. You renew by taking the examination again before expiry, with same-exam eligibility opening after 18 months (545 days). Under the September 2026 policy, passing a higher-level credential in the same track also renews active lower-level credentials. No CPE or CEU renewal quota is published.
Sequencing Your Prep Around the Weights
The weighting suggests a clear order of attack. Because networking underpins everything else on the firewall, start there. Move to device settings next, since many of those features depend on the networking foundation you just built. Save integration and automation for last, when you have a configured environment to automate against.
Domain 1: Networking Configuration
- Build interfaces, zones, virtual routers, and routing in a lab
- Practice NAT and policy interaction until you can predict outcomes
- Trace packet flow end to end for several scenarios
Domain 2: Device Setting Configuration
- Work through administration, authentication, and service routes
- Practice commit, candidate-versus-running configuration, and rollback
- Configure logging and high availability settings
Domain 3: Integration and Automation
- Make API calls against your lab firewall and read the responses
- Write or read a short automation script for a routine task
Integrated Review
- Take timed practice questions across all three domains
- Revisit weak areas, weighting extra time toward Domains 1 and 2
This eight-week arrangement is an illustration, not a prescribed schedule; compress or stretch it based on your hands-on experience. Candidates who work with PAN-OS daily may need far less time on the first two domains. You can check how well your preparation is tracking with realistic questions on the NGFW-Engineer practice test site, and a condensed reference for final review is available in the NGFW-Engineer cheat sheet.
Who This Credential Fits
The issuer recommends two to three years in IT security and two years of experience with its NGFW solutions, plus relevant networking and scripting knowledge. These are recommendations rather than hard gates: there is no mandatory prior credential, no mandatory degree, and no published references requirement. Recommended Network Security Professional or Analyst certifications and training are likewise suggestions, not required credentials or hour quotas. The details are laid out in our guide to NGFW-Engineer requirements and eligibility.
The people who benefit most are those who configure and maintain Palo Alto Networks firewalls as part of their job: network security engineers, firewall administrators, and security operations staff who own PAN-OS deployments. Employers running Palo Alto Networks platforms are the natural audience for this credential. No certification-specific salary premium has been verified, so be skeptical of any source that promises one; the ROI analysis and salary guide discuss how to think about value without inventing numbers.
Key Takeaway
The blueprint rewards operators over memorizers. Hands-on time with PAN-OS across networking, device settings, and basic automation is the single best predictor you can control, and the 40/40/20 weighting tells you exactly where to spend it.
Frequently Asked Questions
Three. The November 2025 datasheet lists PAN-OS Networking Configuration (40%), PAN-OS Device Setting Configuration (40%), and Integration and Automation (20%).
The formal November 2025 blueprint states 20%. A June 2025 community blog quoted 24%, but the currently linked datasheet controls, so plan against 20%.
No. The percentages describe blueprint proportion, and the issuer does not publish an exact question count or per-domain item numbers, so they should not be converted into question tallies.
The Certification Handbook publishes a passing score of 860 on a 300-1000 scale for all Palo Alto Networks certification exams. It is a scaled score, not an 86% raw percentage.
Under the issuer's announcement effective August 1, 2025, new appointments are in-person only through Pearson VUE, even though some residual online-proctoring links may still appear. Confirm current options when you schedule.
To see where you stand against all three domains, work through scenario-style questions on the main NGFW-Engineer practice test, and revisit the pass rate discussion for context on what the available data does and does not show.