PALO ALTO NETWORKSPalo Alto Networks Certified Network Security Architect
The Palo Alto Networks Certified Network Security Architect certification validates the skills and experience required to architect secure, highly available, and scalable systems using the Palo Alto Networks network security portfolio. Designed for experienced architects, it confirms your ability to translate technical and business requirements into complex security blueprints aligned with industry frameworks and compliance objectives. Earning this credential demonstrates your expertise in designing for Zero Trust across the network security platform.
986 practice questions · Updated 2026-07-30
10Domains
45Objectives
272Concepts
986Questions
NETWORK-SECURITY-ARCHITECT Curriculum
Every domain, objective, and concept the NETWORK-SECURITY-ARCHITECT exam measures.
- User-ID design
- Device health and HIP
- Security posture enforcement
- Device-ID design
- Least privilege access controls
- Network Segmentation Definition
- Microsegmentation Definition
- Segmentation Approaches
- Security Benefits Comparison
- Operational and Architectural Differences
- Use Case Selection
- Application-specific access control
- Application identification
- User and group-based access
- Contextual factors in access
- Zero Trust principles for application access
- Continuous Security Scanning Overview
- Traffic Inspection Mechanisms
- Integration with Security Policies
- Threat Prevention Features
- WildFire Integration
- Logging and Reporting
- Performance and Optimization
- Continuous Monitoring Fundamentals
- Analytics in Zero Trust
- Data Collection and Telemetry
- Monitoring Tools and Technologies
- Integration with Zero Trust Architecture
- Alerting and Response
- Continuous Improvement
- Prisma AIRS AI Red Teaming
- Prisma AIRS AI Model Scanning
- Prisma AIRS AI Runtime Security
- Prisma AIRS AI Security
- Prisma AIRS AI Agents
- Prisma AIRS Kubernetes Integration
- Prisma AIRS Microsegmentation
- AI Access App-ID Cloud Engine
- AI Access Advanced Threat Prevention
- AI Access Advanced URL Filtering
- AI Access Enterprise DLP
- AI product categories for AI architectures
- AIRS form factors overview
- Selecting appropriate AIRS form factors
- AI security content types
- Data security in AI environments
- Integrating AI security content and data security
- Application sanctioning
- Controls for sanctioned AI applications
- Data loss prevention (DLP) for AI applications
- AI security frameworks overview
- GDPR compliance for AI
- NIST AI risk management framework
- EU Data Act implications for AI
- PCI DSS compliance for AI
- HIPAA compliance for AI
- Applying security controls based on frameworks
- Panorama HA architecture
- Panorama HA synchronization
- Panorama HA failover and state
- Panorama HA management plane vs data plane
- Log collector redundancy models
- Log collection resilience
- Log collector failover and recovery
- Log storage and retention in HA
- SCM Architecture
- SCM Configuration and Administration
- Strata Logging Service Integration
- Cloud Identity Engine Integration
- SCM, SLS, and CIE Interoperability
- On-premises agent deployment
- Agent synchronization process
- Agent configuration and management
- Cloud Directory integration
- SAML 2.0 support in Cloud Identity Engine
- Entra ID (Azure AD) integration
- Okta integration
- Comparison of sync options
- Strata Logging Service forwarding overview
- Syslog over TLS forwarding
- HTTP forwarding
- Email forwarding
- Integration with third-party SIEM
- Forwarding method selection criteria
- Troubleshooting log forwarding
- User identification methods
- User authentication methods
- Cloud Identity Engine (CIE)
- Cloud Authentication Service (CAS) for SAML
- Recommendation criteria
- Cloud Identity Engine integration with NGFW
- Cloud Identity Engine use cases for Prisma Access
- Cloud Identity Engine integration with Prisma SD-WAN
- Regional vs. Global Prisma Access Deployments
- Prisma Access Regions and Locations
- GlobalProtect Infrastructure Configuration
- IPsec Termination Points in Prisma Access
- Service Connections and Remote Networks
- Traffic Steering and Routing Policies
- High Availability and Redundancy in Prisma Access
- Scaling and Capacity Planning
- Compliance and Data Residency
- Monitoring and Troubleshooting Multi-Region Deployments
- Service connection routing modes
- Service connection failover modes
- ZTNA Connector FQDN and wildcard support
- ZTNA Connector IP subnet and Connector IP Blocks
- ZTNA Connector scalability in CSP environments
- Colo-Connect architecture
- Google Cloud Network Connectivity Center (NCC) integration
- Prisma Browser Overview
- Accessing Private Applications via Prisma Browser
- Prisma Browser Security Features
- Prisma Browser Deployment and Configuration
- Prisma Browser use cases
- Prisma Access Agent use cases
- Explicit proxy use cases
- GlobalProtect use cases
- Comparison of access methods
- GlobalProtect connection methods overview
- On-demand connection method
- User-logon (Always On) connection method
- Pre-logon (Always On) connection method
- Architecting connection method selection
- Prisma Access Architecture for Mobile Users
- Mobile User Onboarding and Configuration
- Security Policies for Mobile Users
- Traffic Forwarding and Routing for Mobile Users
- High Availability and Redundancy for Mobile Users
- Monitoring and Troubleshooting Mobile User Connectivity
- ADEM Overview
- ADEM Architecture
- AI-Powered Capabilities
- Digital Experience Monitoring
- Autonomous Remediation
- Deployment Considerations
- Integration with Security Policies
- Troubleshooting and Optimization
- Prisma Access remote networks architecture
- Prisma Access HA and redundancy
- Prisma SD-WAN architecture
- Prisma SD-WAN design and HA
- PAN-OS SD-WAN features
- PAN-OS SD-WAN design and HA
- ADEM overview and capabilities
- ADEM integration in branch design
- Third-party edge and SD-WAN integration
- Third-party edge HA and migration
- App-ID in Prisma SD-WAN
- Device-ID in Prisma SD-WAN
- User-ID in Prisma SD-WAN
- Threat Prevention in Prisma SD-WAN
- URL Filtering in Prisma SD-WAN
- DNS Security in Prisma SD-WAN
- In-motion (inline) SaaS Security
- At-rest (API) SaaS Security
- SaaS Security Posture Management (SSPM)
- Enterprise DLP and advanced web filtering
- SaaS application usage control overview
- SaaS security posture assessment
- SaaS access control mechanisms
- SaaS data loss prevention (DLP)
- SaaS shadow IT discovery
- SaaS application governance
- SaaS security best practices
- DLP Classifiers
- Traditional and Regex Classifiers
- Exact Data Matching (EDM)
- Indexed Document Matching (IDM)
- Optical Character Recognition (OCR)
- Machine Learning (ML) Classification
- Endpoint DLP
- Policy-Based DLP
- IoT Device Visibility and Discovery
- IoT Risk Assessment
- IoT Device Profiling and Classification
- IoT Enforcement Strategies
- IoT Policy Implementation
- IoT sensor placement options
- Inline vs. passive sensor placement
- Sensor placement at network edge
- Sensor placement in core network
- Sensor placement in cloud
- Sensor placement in IoT gateway
- Factors influencing sensor placement
- NGFW visibility
- Virtual metadata collector
- Prisma SD-WAN visibility
- PAN-OS SD-WAN visibility
- Device-ID fundamentals
- Device-ID data sources
- Device-ID deployment considerations
- Device-ID policy enforcement
- Device-ID troubleshooting and monitoring
- Device Security Capabilities Overview
- Device Profiling and Identification
- Vulnerability and Risk Assessment
- Policy Enforcement for IoT Devices
- Integration with Firewall and Panorama
- Alerting and Remediation Workflows
- AWS NGFW standard integrations
- Azure NGFW standard integrations
- GCP NGFW standard integrations
- OCI NGFW standard integrations
- Maintenance and OS upgrade process
- VPN termination
- SSL decryption
- Centralized vs. decentralized architectures
- AWS NGFW insertion options
- AWS Gateway Load Balancer (GWLB) integration
- Transit Gateway Connect integration
- High availability (HA) design in AWS
- High resilience and scaling in AWS
- NGFW subinterfaces in AWS
- Azure NGFW insertion options
- Azure Load Balancer integration with NGFW
- NGFW high availability in Azure
- Azure NGFW resilience patterns
- GCP NGFW insertion options
- GCP load balancer integration with NGFW
- NGFW high availability in GCP
- GCP NGFW high resilience design
- Cloud NGFW use cases
- VM-Series use cases
- Comparing Cloud NGFW and VM-Series
- Edge Scope Assessment
- Core Scope Assessment
- East-West uSeg Scope Assessment
- Hypervisor-specific resource allocation
- Resource allocation best practices per hypervisor
- Hardware offload for encrypted traffic
- Scaling VM-Series for encrypted traffic
- vCPU sizing for VM-Series
- Hyperthreading considerations
- NUMA placement for VM-Series
- DPDK for VM-Series
- SR-IOV for VM-Series
- Comparing DPDK and SR-IOV
- SSL decryption performance impact
- Hardware acceleration for SSL decryption
- Traffic selection for SSL decryption
- SSL decryption and session handling
- Performance measurement and tuning
- Deployment scenarios and trade-offs
- HA deployment modes
- Hardware firewall clustering generations
- Hyperscale Security Fabric (HSF)
- Fast failover for UDP and TCP
- Route Redistribution Fundamentals
- ECMP (Equal-Cost Multi-Path) Routing
- Static Routing Considerations
- BGP Redistribution
- OSPF Redistribution
- Routing Design Principles
- Routing Protocol Selection
- Redistribution Pitfalls and Loop Prevention
- Systems management options overview
- Considerations for management plane
- Considerations for data plane
- Integration with external management systems
- Management access and authentication
- High availability and redundancy in management
- Monitoring and logging considerations
- Upgrade and maintenance considerations
- Hardware Deployment Trends
- Scoping New Hardware Deployments
- Evaluating Deployment Readiness
- SSL decryption performance factors
- Sizing based on traffic characteristics
- Hardware and platform capabilities
- Impact of decryption on firewall resources
- Best practices for SSL inspection sizing
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for NETWORK-SECURITY-ARCHITECT, so none is invented.