- What the NGFW-Engineer Certification Actually Is
- Who the Credential Targets
- The Three-Domain Blueprint
- Exam Format and What Is Not Published
- Registration, Fees and Delivery Rules
- Scoring and Retake Mechanics
- Validity and Renewal
- Sequencing Your Preparation by Domain
- Where the Credential Fits in a Security Career
- Frequently Asked Questions
- Palo Alto Networks issues this Specialist-level credential in its Network Security track; it validates hands-on PAN-OS engineering skill.
- PAN-OS Networking Configuration and PAN-OS Device Setting Configuration each carry 40%; Integration and Automation carries 20%.
- Palo Alto Networks publishes a passing score of 860 on a 300-1000 scale, not a raw percentage.
- Registration costs USD 250 plus applicable taxes and fees, and new appointments are in-person only.
What the NGFW-Engineer Certification Actually Is
The Palo Alto Networks Certified Next-Generation Firewall (NGFW) Engineer, abbreviated NGFW-Engineer, is a Specialist-level credential issued by Palo Alto Networks within its Network Security track. It targets the people who deploy, configure and integrate Palo Alto Networks next-generation firewalls running PAN-OS. It is a vendor credential tied to one product family, not a general networking or security certification.
The acronym "NGFW-Engineer" is shared by other credentials from other organizations, so it is worth being precise. Everything on this page refers only to the Palo Alto Networks exam. If you want a shorter orientation, our pages on what NGFW-Engineer is and what NGFW-Engineer stands for cover the naming, and the main certification overview collects the essentials in one place.
The emphasis is on practical engineering. The exam objectives center on configuring PAN-OS networking, configuring device-level settings, and integrating and automating the platform. That framing tells you what kind of candidate the exam rewards: someone who has actually built configurations, not someone who has only read about firewall concepts.
Who the Credential Targets
Palo Alto Networks does not require any prior credential, degree or references to sit this exam. What it does publish is a recommended experience profile: roughly two to three years in IT security, about two years working with its NGFW solutions, and relevant networking and scripting knowledge. Those are recommendations, not gates, and the recommended Network Security Professional or Analyst certifications and training courses are not mandatory credentials or hour quotas.
In practice, the natural candidates are:
- Network and security engineers who already operate PAN-OS firewalls day to day and want formal validation.
- Implementation and professional-services engineers who stand up firewalls for customers or partners.
- Systems administrators moving from another vendor's firewall platform into the Palo Alto Networks ecosystem.
- Security engineers whose roles are increasingly about integration and scripted automation rather than purely manual configuration.
For a fuller breakdown of eligibility, see the NGFW-Engineer requirements guide.
The Three-Domain Blueprint
The official exam objectives come from the Next-Generation Firewall Engineer datasheet published in November 2025. That document defines three domains. Two are tied at 40% each, and the third accounts for 20%.
| Domain | Weight | Character of the work |
|---|---|---|
| PAN-OS Networking Configuration | 40% | How traffic enters, is classified, moves through and leaves the firewall |
| PAN-OS Device Setting Configuration | 40% | Configuring and managing the device itself |
| Integration and Automation | 20% | Connecting the firewall to other systems and driving it programmatically |
The weights describe the share of the blueprint, not a guaranteed number of questions. Palo Alto Networks does not publish item counts, so avoid converting percentages into exact question numbers.
Domain 1: PAN-OS Networking Configuration (40%)
This is the largest share of the exam and the most intuitive for candidates with a routing and switching background. Expect scenario-driven questions on how PAN-OS handles traffic at the network layer.
- Interface configuration and the role of zones in defining trust boundaries
- Virtual routers, static and dynamic routing, and how routing decisions affect policy outcomes
- Network address translation and its interaction with security policy
- Tunnels and VPN connectivity between sites and to remote users
- High availability design and failover behavior
Domain 2: PAN-OS Device Setting Configuration (40%)
Tied with networking at 40%, this domain covers the device as a managed system rather than as a packet forwarder. Candidates who treat it as an afterthought tend to lose points here.
- Management plane setup, administrative access and role-based administration
- Authentication and authorization services used for administrators and users
- Certificates and their role in decryption, management and VPN
- Logging, log forwarding and the visibility the device provides
- Configuration management, including commits, candidate versus running configuration, and software and content updates
Domain 3: Integration and Automation (20%)
The smallest domain is the one most likely to differ from a candidate's day job. Even at 20%, it is large enough to decide a borderline result.
- Connecting the firewall to external identity, logging and threat-intelligence systems
- Using APIs to read and change firewall configuration and state
- Scripting and infrastructure-as-code approaches to repeatable deployment
- Centralized management and orchestration across many devices
For a deeper treatment of each content area, read the complete guide to all three NGFW-Engineer exam domains.
Exam Format and What Is Not Published
The exam is delivered by Pearson VUE. The current provider page describes computer-based testing with multiple-choice, matching and ordering question types. That is the general delivery model; the exact mix of question types for this particular exam has not been verified.
Equally important is what the public datasheet does not say. It does not publish an exact question count or a timer for this exam. Anyone quoting a precise number of questions or minutes is either guessing, borrowing a figure from another exam, or citing an unofficial practice bank. We do not substitute those figures here.
Other format facts that are verified: the exam is delivered in English, with a default 30-minute extension for ESL candidates in non-English-speaking countries. No exam-specific calculator is verified, and there is no verified claim that the exam is adaptive. Personal books, notes and other unauthorized materials are prohibited under the Candidate Agreement.
If you are weighing how demanding the exam feels in practice, our NGFW-Engineer difficulty guide discusses it from the candidate's perspective.
Registration, Fees and Delivery Rules
The Specialist registration fee is USD 250 plus applicable taxes and fees. Palo Alto Networks publishes no member versus non-member price distinction. The fee is documented in the Certification Program FAQ and through Pearson's USD voucher store. For a complete look at costs beyond the exam fee, see the NGFW-Engineer certification cost breakdown.
| Item | Published detail |
|---|---|
| Registration fee | USD 250 plus applicable taxes and fees |
| Testing provider | Pearson VUE |
| Delivery for new appointments | In-person at a test center only |
| Language | English; default 30-minute ESL extension in non-English-speaking countries |
| Cancellation or rescheduling | Requires 48 hours' notice |
| Retake waits after failed attempts | 15 days, then 30 days, then 90 days |
In-person delivery only
Under an issuer announcement dated June 30, 2025, effective August 1, 2025, new appointments are in-person only. You may still encounter residual Pearson OnVUE links that appear to offer remote proctoring, but the issuer's announcement governs. Plan around a physical test center, including travel and arrival time. Scheduling specifics are covered in our exam dates and scheduling guide.
Scoring and Retake Mechanics
The Palo Alto Networks Certification Handbook publishes a passing score of 860 on a 300-1000 scale for all of its certification exams. This is a scaled score, not an 86% raw-percentage requirement, and you should not interpret it as needing to answer a fixed share of questions correctly. Results are provisional pending review. A dedicated explanation is available in our NGFW-Engineer passing score guide.
Key Takeaway
Because the scored/unscored split is undisclosed and the score is scaled, do not try to game the exam by estimating how many questions you can afford to miss. Aim for solid competence across all three domains, with no domain left weak.
If you do not pass, the waiting periods escalate: 15 days after the first failed attempt, 30 days after the second, then 90 days. Those intervals make a failed attempt costly in both time and money, which is the practical argument for preparing thoroughly before you book. We discuss public figures and what is and is not known in our pass rate analysis.
Validity and Renewal
The credential is valid for two years. Renewal is by examination before the credential expires. Same-exam eligibility opens after 18 months (545 days), so you can retake the exam in the final stretch of your validity window. Under the September 2026 policy, earning a higher-level credential in the same track also renews active lower-level credentials. No CPE or CEU renewal quota is published, so continuing-education credits are not part of the renewal mechanism.
Because PAN-OS evolves, renewal by re-examination effectively doubles as a currency check on your skills. No exclusive PAN-OS release is verified as being tied to the exam.
Sequencing Your Preparation by Domain
Generic study advice matters less than ordering your effort around the blueprint. Because two domains are tied at 40% and the third is 20%, a sensible plan front-loads the heavy domains and leaves automation for when the platform fundamentals are solid. A longer plan lives in our NGFW-Engineer study guide; the outline below shows the logic.
PAN-OS Networking Configuration
- Build interfaces, zones and virtual routers in a lab, then break them and diagnose the result
- Work through NAT and policy interaction, since routing and translation decisions shape what policy sees
- Practice VPN and high availability scenarios until failover behavior is predictable
PAN-OS Device Setting Configuration
- Configure administrative roles, authentication and certificates end to end
- Work with logging and log forwarding so you understand what visibility the device produces
- Rehearse commit and configuration-management workflows, including rollback
Integration and Automation
- Call the firewall's API directly and script a repeatable change
- Connect external identity and logging systems and confirm the data flows
- Finish with mixed-domain practice and review weak areas
The reason to schedule this way: networking and device settings together account for 80% of the blueprint, and Integration and Automation builds on a working knowledge of both. Candidates who lack scripting experience should begin light API exercises earlier and in parallel, since that domain is where a hands-on skill gap is hardest to close late.
For quick final review, a condensed NGFW-Engineer cheat sheet helps consolidate must-know facts, and timed questions on our practice test site let you rehearse the multiple-choice style under realistic conditions.
Where the Credential Fits in a Security Career
Employers that run Palo Alto Networks firewalls at scale, as well as the partners and managed security providers that deploy them for customers, are the natural audience for this credential. Typical roles include network security engineer, firewall engineer, security implementation engineer and professional-services consultant. For a look at the job market side, see our page on NGFW-Engineer jobs.
On compensation, be cautious. No certification-specific salary premium has been verified for this credential, so we do not quote earnings figures. A reasonable way to think about it is that the certification supports a hiring or promotion case by proving platform skill, rather than carrying a guaranteed pay bump. Our salary guide and the worth-it ROI analysis explore how to weigh that honestly against the USD 250 fee and your preparation time.
Frequently Asked Questions
It is a Specialist-level credential in Palo Alto Networks' Network Security track. It validates the ability to configure PAN-OS networking, configure device settings, and handle integration and automation on Palo Alto Networks next-generation firewalls.
PAN-OS Networking Configuration and PAN-OS Device Setting Configuration are each 40%, and Integration and Automation is 20%, according to the November 2025 datasheet. These are blueprint weights, not published question counts.
Palo Alto Networks publishes a passing score of 860 on a 300-1000 scale for its certification exams. That is a scaled score, not an 86% raw requirement, and results are provisional pending review.
No. Under the issuer's announcement effective August 1, 2025, new appointments are in-person only, even though some residual Pearson OnVUE links may still appear. Book a test center appointment through Pearson VUE.
It is valid for two years. Renew by passing the exam again before expiry; same-exam eligibility opens after 18 months. A higher-level credential in the same track can also renew active lower-level credentials, and no CPE or CEU quota is published.