Palo Alto certifications in 2026: PCNSE is retired, here’s what replaced it
Checked on 15 Oct 2026 against Palo Alto Networks and Pearson VUE pages. By Radhe, Ping My Lab.
PCNSE retired on 31 July 2025, and Palo Alto’s 2026 firewall path is Network Security Professional, Network Security Analyst and Next-Generation Firewall (NGFW) Engineer. Most firewall engineers should take Network Security Analyst first, then NGFW Engineer.
01What retired, and when
Palo Alto replaced its product exams with role-based certifications during 2025. Three changes matter to firewall engineers.
| Change | When | What it means now |
|---|---|---|
| PCNSA retired, with PCCET and PCFSE | 31 Jan 2025 | Cannot be booked |
| PCNSE retired | 31 Jul 2025 | Cannot be booked. A PCNSE you already hold stays active for two years. |
| Online proctoring ended | After 31 Jul 2025 | Since 1 Aug 2025, every Palo Alto exam is taken at a Pearson VUE test centre. |
Skip any course or book that still sells PCNSA or PCNSE preparation.
02If you already hold a PCNSE
- Palo Alto says your PCNSE stays active for two years from the date you achieved it.
- Palo Alto also says “there is no direct equivalence” between the old and new certifications. The old exams focused on product knowledge; the new ones validate job-ready skills.
- The exam no longer runs, so every PCNSE expires by the end of July 2027 at the latest.
- To stay certified, plan a new exam before yours expires. Which one to take first is below.
03The new role-based certifications, and who each is for
Palo Alto’s Network Security track has four levels: Foundational, Professional, Specialist and Architect. Three certifications cover firewall work.
| Certification | Who it is for, and what it tests |
|---|---|
| Network Security ProfessionalProfessional level. Called Network Security Generalist until 30 May 2025. | Entry level, for people who install, deploy, operate or administer Palo Alto network security products. Broad: NGFWs, SASE (Prisma Access and Prisma SD-WAN), Cloud-Delivered Security Services, Panorama and Strata Cloud Manager. |
| Network Security AnalystSpecialist level. Released 31 Mar 2025. | For network security analysts, firewall administrators, and network and security engineers who build objects and policies. Objects 30%, policies 30%, management and operations 26%, troubleshooting 14%. The operations domain is built around Strata Cloud Manager and Strata Logging Service. |
| Next-Generation Firewall EngineerSpecialist level. Announced 30 Jan 2025. | For network, security and firewall engineers, firewall administrators and professional services consultants. PAN-OS networking 40%, device settings 40%, integration and automation 20%. It also covers Panorama, VM-Series, CN-Series and Cloud NGFW. |
The Specialist level also holds SD-WAN Engineer and Security Service Edge Engineer. Network Security Architect sits at the Architect level. Passing a higher-level certification extends your active lower-level ones in the same track.
04Which one a firewall engineer should take first
Take Network Security Analyst first, then NGFW Engineer, unless you already run Palo Alto firewalls in production.
- It is Palo Alto’s own order. The NGFW Engineer datasheet recommends Network Security Professional and Network Security Analyst first, but does not require them. It also recommends 2 to 3 years in IT security and 2 years with Palo Alto NGFWs.
- Most of the Analyst exam is daily firewall work. Objects and policies make up 60%: security profiles, EDLs, NAT, App-ID, decryption, User-ID and policy-based forwarding. You can build most of it on a lab firewall.
- Plan extra study for Analyst domain 3 (26%). It is built around Strata Cloud Manager, which you cannot fully practise on a stand-alone VM-Series. Use Palo Alto’s free OLX Strata Cloud Manager course and a Network Security Management Ultimate Test Drive.
- Already configure PAN-OS every day? Then NGFW Engineer can come first. Most of its weight, networking and device settings, is hands-on work.
- Network Security Professional is optional. Neither Specialist exam requires it. Take it first only if you want a broad entry-level certificate that also covers Prisma Access and SASE.
05How the exams are delivered, and what they cost
NGFW Engineer and Network Security Analyst follow the same rules.
| Item | Both Specialist exams |
|---|---|
| Where | A Pearson VUE test centre only, since 1 Aug 2025 |
| Fee | USD 250 each, plus taxes and fees that vary by country |
| Question types | Multiple choice, matching and ordering |
| Language | English. Candidates in non-English-speaking countries get 30 extra minutes by default. |
| Length | Question count and duration are not published. Check the time shown when you book. |
| Pass mark | 860 on a scaled score of 300 to 1000 |
| Valid for | Two years from the pass date. Recertify by retaking the exam. |
| After a fail | Wait 15 days after the first, 30 after the second, and 90 after the third and later |
| After a pass | 545 days (18 months) before you can sit the same exam again |
The other levels cost USD 150 (Foundational), USD 200 (Professional) and USD 300 (Architect), plus taxes.
Book through Pearson VUE’s Palo Alto Networks page, which lists the exams as “Next-Gen Firewall Engineer” and “Network Security Analyst”. That page still links to OnVUE online testing, but Palo Alto’s own rule is test centres only. Reschedule or cancel at least 48 hours ahead; later changes and no-shows forfeit the fee.
Some websites quote question counts, durations and exam codes. None appear on Palo Alto’s or Pearson VUE’s pages, so do not plan around them.
06Exam areas mapped to the labs
Each exam domain, and the labs in Ping My Lab’s PAN-OS 12.1 course that practise it. The numbers are the course’s lab numbers.
NGFW Engineer
| Domain | Labs |
|---|---|
| 1 PAN-OS networking configuration40% |
|
| 2 PAN-OS device setting configuration40% |
|
| 3 Integration and automation20% |
|
Network Security Analyst
| Domain | Labs |
|---|---|
| 1 Object configuration creation and application30% |
|
| 2 Policy creation and application30% |
|
| 3 Management and operations26% |
|
| 4 Troubleshooting14% |
|
Taught as concept or demo only: virtual systems, web proxy, Panorama, Strata Logging Service, log collectors, and the data security, IoT and SD-WAN items. Most of Analyst domain 3 needs a working Strata Cloud Manager tenant for hands-on practice.
Sources
Every page below was opened and checked on 15 Oct 2026. Fees and rules change, so recheck them when you book.
- What Is Replacing the PCNSE? (LIVEcommunity): retirement, validity, no direct equivalence.
- New Certifications: Next-Generation Firewall Engineer and XSIAM Engineer (LIVEcommunity, 30 Jan 2025): PCNSA retirement.
- Introducing Four More Role-Based Certifications (LIVEcommunity, 14 Mar 2025): Analyst release date.
- Introducing Professional-Level Certifications (LIVEcommunity, 15 May 2025): the Professional rename.
- Important Update: Enhancing the Value of Your Certification (LIVEcommunity, 30 Jun 2025): test centres only.
- Network Security Professional page and datasheet (June 2026).
- Network Security Analyst page and datasheet (August 2025).
- NGFW Engineer page and datasheet (November 2025).
- Certification Program FAQs (September 2026): fees, validity, retakes.
- Certification Handbook (September 2026): pass mark, booking rules.
- Pearson VUE: Palo Alto Networks (updated 29 Sep 2026): exam names, question types.
The lab map and study advice come from Ping My Lab’s PAN-OS 12.1 course kit. Its exam facts were checked on Palo Alto Networks and Pearson VUE pages on 13 Oct 2026.