- The Plain-English Definition
- Who Issues It and Where It Sits
- What the Exam Actually Covers
- What an NGFW Engineer Does All Day
- Exam Format, Delivery and Scoring
- Registration, Fees and Retake Rules
- Who Should Sit It
- Validity and Renewal
- A Domain-Weighted Prep Sequence
- Who Hires for This Credential
- Frequently Asked Questions
- NGFW-Engineer here means the Palo Alto Networks Certified Next-Generation Firewall (NGFW) Engineer, a Specialist-level credential in the Network Security track.
- Two domains, PAN-OS Networking Configuration and PAN-OS Device Setting Configuration, carry 40% each; Integration and Automation carries 20%.
- Registration costs USD 250 plus applicable taxes and fees, and the passing score is 860 on a 300-1000 scale.
- New exam appointments are in-person only through Pearson VUE, effective August 1, 2025.
The Plain-English Definition
If you have seen the phrase "NGFW-Engineer" on a job board, a training page or a forum thread and wondered what it refers to, here is the short answer: it is the Palo Alto Networks Certified Next-Generation Firewall (NGFW) Engineer credential. It validates that a person can configure, set up and integrate Palo Alto Networks next-generation firewalls running PAN-OS. It is a hands-on, configuration-focused certification, not a vendor-neutral theory exam.
A quick caution about the name: several other credentials in the industry use similar shorthand. Everything on this page applies only to the Palo Alto Networks exam. If you are comparing it against other firewall or security certifications, keep the issuer front and center, because exam fees, blueprints and renewal rules differ completely from vendor to vendor. For other angles on the same topic, see our related explainers: What Is NGFW-Engineer?, What Does NGFW-Engineer Stand For? and NGFW-Engineer Meaning.
Who Issues It and Where It Sits
The credential is issued by Palo Alto Networks and classified at the Specialist level within the Network Security track of the company's certification program. The issuer's official landing page for the exam is on paloaltonetworks.com under its education services section, and the published blueprint comes from the Next-Generation Firewall Engineer Datasheet (November 2025 edition).
Being a Specialist-level credential matters for two reasons. First, it signals depth in a specific product area rather than broad generalist knowledge. Second, it interacts with the renewal rules: under the September 2026 policy, earning a higher-level credential in the same track can also renew active lower-level credentials. We cover the mechanics further down.
What the Exam Actually Covers
The published exam blueprint has exactly three domains. These weights come from the official datasheet and are the authoritative source. For a deeper walk-through of each area, read our complete guide to all 3 content areas.
| Domain | Weight | Character of the work |
|---|---|---|
| PAN-OS Networking Configuration | 40% | Getting traffic flowing correctly through the firewall |
| PAN-OS Device Setting Configuration | 40% | Configuring and managing the device itself |
| Integration and Automation | 20% | Connecting the firewall to other systems and scripting around it |
Domain 1: PAN-OS Networking Configuration (40%)
This is where most firewall engineers live day to day. Expect to reason about how interfaces, zones, virtual routers and routing behavior combine to move (or block) packets.
- Interface types and deployment modes, and when each is appropriate
- Security zones and how they shape policy and traffic flow
- Virtual routers, static and dynamic routing, and path selection
- NAT behavior and how it interacts with security policy and routing
- Troubleshooting why a session is dropped, misrouted or translated unexpectedly
Domain 2: PAN-OS Device Setting Configuration (40%)
Tied with networking at 40%, this domain covers the configuration of the firewall as a managed device rather than a packet forwarder.
- Management access, administrative roles and authentication settings
- Certificate handling and the services that depend on it
- Logging, reporting and log forwarding configuration
- Updates, content and licensing behavior
- Configuration management, commits and operational hygiene
Domain 3: Integration and Automation (20%)
The smallest domain, but the one that separates a button-clicker from a modern network engineer. It reflects the issuer's recommendation that candidates bring relevant scripting knowledge.
- Integrating the firewall with external identity, logging and security systems
- Using APIs and scripting to configure or query the device programmatically
- Understanding how automation fits into repeatable, auditable change processes
What an NGFW Engineer Does All Day
The certification is built around a job role, so it helps to picture the job. An NGFW engineer typically owns the lifecycle of firewalls running PAN-OS: onboarding a new device, building the interface and routing foundation, standing up the management plane, tuning logging, and then maintaining all of it through updates and change requests. Increasingly, the role also involves wiring the firewall into broader tooling so that routine changes are scripted rather than clicked.
That job description maps directly onto the three domains. Networking configuration is the "make it work" layer, device settings are the "make it manageable and observable" layer, and integration and automation are the "make it scale" layer. If your daily work touches all three, the exam will feel like a structured review of things you already do. If your experience is lopsided, say, heavy on policy but light on routing, the blueprint will expose the gap quickly. For a realistic sense of the challenge, see how hard the NGFW-Engineer exam really is.
Exam Format, Delivery and Scoring
Question style
The testing provider is Pearson VUE. Its current provider page describes the Palo Alto Networks exams as computer-based, using multiple-choice, matching and ordering question types. The exact item mix for this specific exam, the current question count and the base duration have not been verified, and the public datasheet does not publish an exact question count or timer. Treat any website that quotes a precise number of questions or minutes as unverified unless it cites the issuer.
Scoring
The Palo Alto Networks Certification Handbook publishes a passing score of 860 on a 300-1000 scale for all of its certification exams. That is a scaled score, not an 86% raw requirement, so you cannot back-calculate a number of questions you may miss. The split between scored and unscored items is undisclosed, and unidentified pretest items may appear in your exam; they do not affect your score. Our dedicated page on the NGFW-Engineer passing score goes deeper on what that means in practice.
Delivery rules
- In-person only for new appointments. Under the issuer's June 30, 2025 announcement, effective August 1, 2025, new appointments are delivered at test centers, even though some residual Pearson OnVUE links may still appear online.
- English delivery, with a default 30-minute ESL extension in non-English-speaking countries.
- No personal books or notes. Unauthorized materials are prohibited under the Candidate Agreement.
- No exam-specific calculator or adaptive-testing claim has been verified.
Key Takeaway
Because the question count and timer are not publicly confirmed, check your Pearson VUE appointment details for the authoritative numbers, and practice reading configuration scenarios quickly rather than optimizing against a guessed time-per-question figure.
Registration, Fees and Retake Rules
The Specialist registration fee is USD 250 plus applicable taxes and fees, as stated in the Certification Program FAQ and reflected in Pearson's USD voucher store. No member versus non-member price distinction is published. For a full breakdown of what else you might spend, see our NGFW-Engineer certification cost guide.
| Policy | What is published |
|---|---|
| Registration fee | USD 250 plus applicable taxes/fees |
| Cancel or reschedule | Requires 48 hours' notice |
| Waits after failed attempts | 15 days, then 30 days, then 90 days |
| Results | Provisional pending review |
| Prerequisite credential | None mandatory |
Scheduling specifics, including testing windows and availability, are covered in our exam dates and scheduling guide, and eligibility details are in the requirements breakdown.
Who Should Sit It
There is no mandatory prior credential, no required degree and no published references requirement. What the issuer does offer is a recommended profile: roughly 2-3 years in IT security and 2 years working with Palo Alto Networks NGFW solutions, plus relevant networking and scripting knowledge. These are recommendations, not gates. Likewise, the issuer's suggested Network Security Professional or Analyst certifications and training are helpful context, not required credentials or hour quotas.
In practice, the best-fit candidates are:
- Network or security engineers who already configure PAN-OS devices in production
- Administrators moving from another firewall vendor who want a structured way to prove PAN-OS fluency
- Partner and consulting engineers who deploy these firewalls for customers
- Engineers expanding into automation who want the Integration and Automation domain as a forcing function
If you are weighing the credential's career value, our analysis in Is the NGFW-Engineer certification worth it? lays out the trade-offs. One honest caveat: no certification-specific salary premium has been verified, so read the salary guide as context about the role rather than a promised bump.
Validity and Renewal
The certification is valid for two years. Renewal is by examination, not by accumulating continuing-education credits; no CPE or CEU quota is published. The rules to remember:
- You may renew by re-taking the exam before your credential expires.
- Same-exam eligibility opens after 18 months (545 days).
- Under the September 2026 policy, earning a higher-level credential in the same track also renews your active lower-level credentials.
A Domain-Weighted Prep Sequence
Rather than a generic study calendar, sequence your preparation around the blueprint. Networking and device settings are each 40%, so together they are 80% of the exam and deserve the bulk of your time. Here is one way to order the work for a candidate with solid but uneven experience; adapt it to your own gaps. The full approach is in our NGFW-Engineer study guide.
Networking foundations (Domain 1)
- Build interfaces, zones and virtual routers in a lab, then break them deliberately
- Trace a session end to end through routing, NAT and policy
Device settings (Domain 2)
- Configure admin roles, certificates, logging and log forwarding hands-on
- Practice commit workflows and configuration management
Integration and Automation (Domain 3)
- Script a few repeatable configuration and query tasks against the device
- Map each integration type to the problem it solves
Mixed review
- Work scenario questions that cross domains, then revisit weak areas
- Use the practice tests to find remaining gaps
Why this order? Networking comes first because it underpins how you reason about everything else on the platform, and the 20% automation domain is easiest to learn once you understand what you are automating. For a compact last-minute reference, keep the NGFW-Engineer cheat sheet handy.
Who Hires for This Credential
Palo Alto Networks firewalls are deployed across enterprises, service providers, government and education, so demand for engineers who can run them is broad rather than concentrated in one sector. The roles that most often reference this skill set include:
- Network security engineers at enterprises with Palo Alto Networks perimeter and data-center firewalls
- Managed security service providers operating firewalls on behalf of many customers
- Systems integrators and resellers that deploy and support the platform
- Cloud and hybrid-infrastructure teams extending policy across environments
Job postings usually emphasize hands-on PAN-OS experience first and the certification second, so treat the credential as proof of what you can already do rather than a substitute for lab time. See NGFW-Engineer jobs for more on how employers frame the role, and NGFW-Engineer training for learning paths.
Frequently Asked Questions
It is the Palo Alto Networks Certified Next-Generation Firewall (NGFW) Engineer, a Specialist-level Network Security credential that validates your ability to configure, set up and integrate PAN-OS firewalls.
PAN-OS Networking Configuration and PAN-OS Device Setting Configuration are each 40%, and Integration and Automation is 20%, according to the November 2025 datasheet. A 24% figure for automation seen in an earlier community post is superseded by the formal blueprint.
Registration is USD 250 plus applicable taxes and fees, booked through Pearson VUE. New appointments are in-person at a test center under the policy effective August 1, 2025.
The published passing score is 860 on a 300-1000 scale. It is a scaled score rather than an 86% raw percentage, and the exact number of questions and the scored/unscored split are not disclosed.
It is valid for two years. You renew by passing the exam again before expiry, with same-exam eligibility starting after 18 months, or by earning a higher-level credential in the same track. No CPE or CEU quota applies. See the NGFW-Engineer certification overview for more.