Engineers still search for the PCNSA and PCNSE, but Palo Alto Networks has moved to a role-based certification framework, so anyone planning a firewall or Cortex credential needs to know which exams exist now and what they test. This guide explains the current Palo Alto Networks certification levels (Foundational, Professional, Specialist and Architect), what happened to the PCNSE, which current exams cover the work the PCNSA and PCNSE used to cover, and the Cortex security operations path. It covers published domains and weights, fees, scoring, retake rules and recertification, plus a preparation plan. It is for firewall administrators, network and security engineers and SOC staff who work with Palo Alto Networks products. Facts were checked on Palo Alto Networks pages, datasheets, FAQ and Certification Handbook on 8 November 2026.
This is an independent guide from NHI Mgmt Group, based on Palo Alto Networks' public documentation as of November 2026. It is not sponsored or reviewed by Palo Alto Networks. Product features change, so confirm settings against Palo Alto Networks' current documentation.
Key takeaways
- The PCNSE exam retired on 31 July 2025. Palo Alto Networks says there is no direct equivalent, and points NGFW candidates to role-based exams; existing PCNSE certifications stay active for two years from the date earned.
- Four levels, one fee ladder. Foundational (USD 150), Professional (USD 200), Specialist (USD 250) and Architect (USD 300), excluding local taxes, per the certification FAQ dated September 2026.
- Firewall work now maps to two Specialist exams. Network Security Analyst covers objects, policy, management and troubleshooting; Next-Generation Firewall Engineer covers PAN-OS networking, device settings, integration and automation.
- Cortex has its own track. Security Operations Professional covers XDR, XSOAR and XSIAM basics, with Specialist exams for XDR, XSIAM and XSOAR roles and a Security Operations Architect at the top.
- Every exam uses the same pass mark and validity. Scores are scaled from 300 to 1000 with a pass at 860, and certifications last two years; passing a higher exam in the same track extends active lower ones.
Who the certification is for
| Level | Certifications on the Palo Alto Networks page (November 2026) | Typical audience |
|---|---|---|
| Foundational | Cybersecurity Apprentice; Cybersecurity Practitioner | People moving into cyber security and those starting a Palo Alto Networks programme |
| Professional | Network Security Professional; Security Operations Professional; Cloud Security Professional | Practitioners who install, operate or administer products across a whole solution area |
| Specialist | Network Security Analyst; Next-Generation Firewall Engineer; SD-WAN Engineer; Security Service Edge Engineer; XSIAM Analyst; XDR Analyst; XSIAM Engineer; XDR Engineer; XSOAR Engineer; Cloud Security Engineer | Experienced engineers and analysts in one product role |
| Architect | Network Security Architect; Security Operations Architect | Senior engineers and architects designing deployments |
Where the PCNSA and PCNSE fit now
Palo Alto Networks' LIVEcommunity article "What Is Replacing the PCNSE?" (updated 12 June 2025) states the PCNSE exam retired on 31 July 2025, alongside the PCCSE and PCSAE. It names the Network Security Generalist, Network Security Analyst and Next-Generation Firewall Engineer certifications as the role-based options for NGFW work. The PCNSA is not listed on the current certification page as of November 2026. In our view at NHI Mgmt Group, its configuration and policy scope sits closest to the Network Security Analyst exam, and the broader solution scope sits with the Network Security Professional (the current page lists Network Security Professional at the Professional level; "Network Security Generalist" appears only in that page's metadata). Holders of legacy certifications can download an eCertificate from the Certification Management System.
Exam format and domains
Common rules
| Item | What Palo Alto Networks publishes | Source |
|---|---|---|
| Delivery | Pearson test centres; vouchers bought from the Pearson voucher store | Certification Handbook; FAQ |
| Language | English worldwide; candidates in non-English-speaking countries get a 30-minute extension by default | Certification Handbook; NGFW Engineer datasheet |
| Scoring | Scaled 300 to 1000; pass at 860 for all exams; results provisional until data forensics review; pretest questions unscored; no rescoring | Certification Handbook |
| Cancellation | Cancelling or rescheduling less than 48 hours ahead forfeits the fee; no-shows pay the fee | Certification Handbook |
| Accommodations | Requested through [email protected] | Certification Handbook |
The pages and datasheets checked do not state question counts or exam durations. Check the Pearson VUE scheduling page for the exam you book.
Network security exams
| Exam | Domains and weights (datasheet) | Datasheet date |
|---|---|---|
| Network Security Professional | Network Security Fundamentals 17%; NGFW and SASE Solution Functionality 13%; Platform Solutions, Services, and Tools 30%; NGFW and SASE Solution Maintenance and Configuration 10%; Infrastructure Management and CDSS 17%; Connectivity and Security 13% | June 2026 |
| Network Security Analyst | Object Configuration Creation and Application 30%; Policy Creation and Application 30%; Management and Operations 26%; Troubleshooting 14% | August 2025 |
| Next-Generation Firewall Engineer | PAN-OS Networking Configuration 40%; PAN-OS Device Setting Configuration 40%; Integration and Automation 20% | November 2025 |
The Network Security Analyst page describes operations using Strata Cloud Manager and Strata Logging Service. The Network Security Professional datasheet expects familiarity with Strata and Prisma SASE products and management through Panorama or Strata Cloud Manager. For deployment depth on the SASE side, see the Palo Alto Prisma Access Configuration Guide.
Cortex security operations exams
| Exam | Domains and weights (datasheet) | Datasheet date |
|---|---|---|
| Security Operations Professional | Security Operations Fundamentals 25%; Threat Intelligence and Incident / Case Response 16%; Cortex XDR 23%; Cortex XSOAR 16%; Cortex XSIAM 20% | July 2026 |
| XSIAM Engineer | Planning and Installation 22%; Integration and Automation 30%; Content Optimization 24%; Maintenance and Troubleshooting 24% | August 2025 |
The XSIAM Engineer page lists installation, deployment configuration, data source onboarding, integration, playbook creation and detection engineering, and names security operations, SIEM and detection engineers as the audience. Its datasheet expects working knowledge of scripting and query languages such as Python, PowerShell, SQL, regular expressions and XQL. The Security Operations Professional datasheet expects an understanding of SOC processes, MITRE ATT&CK and incident response plans. For platform context, see the Palo Alto Networks Cortex XSIAM guide. The XDR Analyst, XDR Engineer, XSIAM Analyst and XSOAR Engineer exams each have their own page and datasheet linked from the certification page.
Prerequisites and experience
The exam pages checked list no formal prerequisites. Recommended experience is stated in some datasheets:
- Next-Generation Firewall Engineer: two to three years in an IT security-related field, including two years with Palo Alto Networks NGFW solutions. Recommended courses are EDU-210 Firewall Essentials: Configuration and Management and Panorama: NGFW Management, as needed.
- Network Security Analyst: aimed at experienced analysts, firewall administrators and engineers who create objects and policies, manage operations or troubleshoot; the datasheet gives no years.
- Network Security Professional and Security Operations Professional: skills-based expectations rather than years, covering basic deployment and use across the solution area.
- XSIAM Engineer: described as for experienced security operations engineers; recommends the instructor-led Cortex XSIAM: Security Operations, Integration, and Automation course as needed.
- Cybersecurity Practitioner: foundational knowledge across network, endpoint, cloud security and security operations; suitable for people entering the field.
Preparation plan
A suggested sequence from NHI Mgmt Group for a firewall administrator aiming at the NGFW Engineer, or a SOC analyst aiming at a Cortex Specialist exam. Allow eight to ten weeks alongside work.
- Week 1, pick the role and download the datasheet. Choose the exam that matches the job you do, then turn each domain and subtopic in its datasheet into a checklist. Palo Alto Networks says the datasheet should not be your only study resource.
- Weeks 2 to 4, digital learning path. Work through the free digital learning path linked from the exam page on the Palo Alto Networks learning portal, noting which subtopics you have never configured.
- Weeks 4 to 7, hands-on practice. For network exams, configure zones, interfaces, NAT, security and decryption policy, device settings, Panorama templates and an automation task in a lab. For Cortex exams, onboard a data source, tune a detection and build a playbook. Treat API keys and service accounts used for integration as production credentials even in a lab. See the API Key Management Guide.
- Week 8, instructor-led gaps. Take the recommended instructor-led course only for domains you cannot practise yourself.
- Week 9, review weights. Spend time in proportion to domain weight: for the NGFW Engineer, 80% of the exam is PAN-OS networking and device settings.
- Week 10, book and sit. Book at a Pearson test centre and avoid changes within 48 hours of your slot. If you need a retake, the waits are 15 days, then 30 days, then 90 days.
Cost, renewal and continuing education
| Item | Published detail |
|---|---|
| Foundational exam fee | USD 150 |
| Professional exam fee | USD 200 |
| Specialist exam fee | USD 250 |
| Architect exam fee | USD 300 |
| Validity | Two years from the passing date |
| Recertification | Retake the exam before it expires; passing a higher-level exam in the same track extends active lower-level certifications by two years |
| Retired exams | The certification stays active for two years from its issue date |
| Retake waits | 15 days after a first fail, 30 days after a second, 90 days after a third and each later attempt |
| Repeat after passing | The same exam cannot be retaken for 18 months (545 days) |
Fees exclude taxes and fees that vary by country. The 18-month rule means you cannot renew a certification by retaking the same exam until 18 months after passing, which leaves a six-month renewal window before the two-year expiry, unless you renew by passing a higher exam in the same track. Renewal is by exam rather than by continuing education credits.
Where it fits on the career path
- Entry: Cybersecurity Apprentice or Practitioner alongside a general networking foundation. See the CompTIA Network+ Certification Guide for vendor-neutral networking groundwork.
- Firewall administrator: Network Security Analyst, then Next-Generation Firewall Engineer as you take on design-level configuration and automation.
- Network security engineer: Network Security Professional for breadth across NGFW and SASE, with SD-WAN or Security Service Edge Engineer for those roles, then Network Security Architect. See the Network Security Engineer Career Guide.
- SOC analyst and engineer: Security Operations Professional, then XDR or XSIAM Analyst, then XSIAM, XDR or XSOAR Engineer, then Security Operations Architect. See the SOC Analyst Career Guide and the Detection Engineer Career Guide.
- Cloud security: Cloud Security Professional, then Cloud Security Engineer. See the Cloud Security Engineer Career Guide.
Product certifications show you can run a specific platform well. Pair them with a vendor-neutral credential if you want to show broader security knowledge. See the Cybersecurity Certifications Guide.
Where identity fits
Several exam domains involve machine identities: the Integration and Automation domains in the NGFW Engineer and XSIAM Engineer exams rely on API keys, service accounts and integration credentials, and firewall administration involves administrator roles and certificate management for decryption. Candidates who practise least-privilege admin roles, scoped API keys and certificate rotation build habits that carry straight into production. See the NHI Authentication Guide.
Practitioner checklist
- Confirm the exam still appears on the Palo Alto Networks certification page before you buy a voucher.
- Download the current datasheet and plan study time by domain weight.
- Complete the digital learning path, then fill gaps with hands-on lab work.
- Use least-privilege admin roles and scoped API keys in your lab, as you would in production.
- Note the 860 pass mark on the 300 to 1000 scale, and the 48-hour cancellation rule.
- Record your pass date, the 18-month repeat block and the two-year expiry.
- Plan renewal through a higher exam in the same track where it suits your career.
- If you hold a PCNSE, note its two-year expiry and choose the current role-based exam that matches your job.
Standards and references
- Palo Alto Networks: Certification
- Palo Alto Networks: Certification Handbook
- Palo Alto Networks: Certification FAQ
- Palo Alto Networks LIVEcommunity: What Is Replacing the PCNSE?
- Palo Alto Networks: Next-Generation Firewall Engineer datasheet
- Palo Alto Networks: Network Security Analyst datasheet
- Palo Alto Networks: Security Operations Professional datasheet
- Palo Alto Networks: XSIAM Engineer datasheet
Related NHI Mgmt Group resources: Network Security Engineer Career Guide, Palo Alto Networks Cortex XSIAM, Palo Alto Prisma Access Configuration Guide, Certification Renewal and CPE Requirements Guide.