You can see it againUnder pressure people bring back shapes and positions long after the wording has gone.
Picture superiority · Shepard 1967, Standing 1973
PALO ALTO NETWORKSPalo Alto Networks Certified Network Security Professional
The Palo Alto Networks Certified Network Security Professional certification validates your ability to implement, administer, and maintain Palo Alto Networks network security solutions, including Next-Generation Firewalls and SASE technologies. It is designed for professionals who manage network security operations and want to demonstrate hands-on expertise with the industry's leading security platform. Earning this credential signals that you can effectively protect your organization's network infrastructure against evolving threats.
Exam formatMultiple choice and performance-based
DeliveryPearson VUE
Free questions540
Content last reviewed 30 July 2026 · Up to date
The certification
What Palo Alto Networks Certified Network Security Professional proves, and what it asks of you
What this certification covers, who it is written for, and what the exam itself looks like on the day.
6domains
22objectives
144concepts
What it is
What this certification is
What it validates, who it is written for, and the experience it assumes.
About this certification
The Palo Alto Networks Certified Network Security Professional certification validates the knowledge and skills required to perform operations and management tasks across the Palo Alto Networks network security platform. It is designed for individuals who want to demonstrate their ability to implement, administer, and maintain Palo Alto Networks Next-Generation Firewalls and SASE technologies, ensuring robust protection for their organization's network infrastructure.
This certification covers the full spectrum of network security operations, from initial configuration and deployment to ongoing management and troubleshooting. It emphasizes practical, hands-on skills that are directly applicable to real-world scenarios, making it a valuable credential for network security professionals seeking to advance their careers. By earning this certification, you prove your capability to secure your organization's network against sophisticated cyber threats and to maintain a resilient security posture.
Who it’s for
This certification is for network security professionals who are responsible for the implementation, administration, and maintenance of Palo Alto Networks network security solutions. It is ideal for individuals who work with Next-Generation Firewalls and SASE technologies in their daily operations and want to formalize their expertise. Typical roles include network security engineers, firewall administrators, and security operations personnel who manage and operate Palo Alto Networks products. If you are looking to validate your hands-on skills and advance your career in network security, this certification is designed for you.
Recommended experience
Palo Alto Networks recommends that candidates have foundational knowledge of networking and cybersecurity concepts, as well as experience with Palo Alto Networks products. Understanding of networking fundamentals, including TCP/IP, routing, and switching; Familiarity with cybersecurity concepts and best practices; Hands-on experience with Palo Alto Networks Next-Generation Firewalls and SASE technologies; Knowledge of network security operations and management tasks
The syllabus
What you’ll learn
Every domain and objective Palo Alto Networks measures, with the weight they carry on the exam.
The official Palo Alto Networks exam outline · checked 30 July 2026 · See the source
Network Security Fundamentals
- 1.1 Explain Application Layer inspection for Strata and SASE products
- 1.2 Explain the functionality of slow path and fast path for packet inspection
- 1.3 Explain the use of decryption on Strata and SASE products (e.g., SSL Forward Proxy, SSL Inbound Inspection, SSH Proxy, no decrypt)
- 1.4 Explain the application of network hardening methods for enhanced security on Strata and SASE products (e.g., Content-ID, Zero Trust, User-ID, Device-ID, Zones)
NGFW and SASE Solution Functionality
- 2.1 Explain the function of Cloud NGFWs, PA-Series, CN-Series, and VM-Series firewalls (e.g., perimeter and core security, zone security and segmentation, high availability [HA], security and NAT policy implementation, monitoring and logging)
- 2.2 Explain the function of Prisma SD-WAN (e.g., WAN optimization, path and NAT policies, Zone-based firewalls, monitoring and logging)
- 2.3 Explain the function of Prisma Access (e.g., remote user configuration, remote network configuration, public and private application access, security and NAT policy implementation, monitoring and logging)
- 2.4 Explain the functionality of Panorama and Strata Cloud Manager (SCM) for managing Strata and SASE solutions
Platform Solutions, Services, and Tools
- 3.1 Explain the security efficacy of Palo Alto Networks NGFW and Prisma SASE products (e.g., security and NAT policy, User-ID, App-ID, decryption, monitoring and logging)
- 3.2 Explain the functionality of Cloud-Delivered Security Services (CDSS) components
- 3.3 Explain the alignment of AIOps to Palo Alto Networks best practices (e.g., dashboards, Best Practice Assessment [BPA], administration)
- 3.4 Explain how Next-Generation Trust Security (NGTS) supports identity governance, trust relationships, and adaptive security decisions across the enterprise platform
- 3.5 Identify and describe quantum security risks (e.g., harvest now, decrypt later attacks) and Palo Alto Networks platform capabilities to address them (e.g., post-quantum readiness, hybrid cryptography)
- 3.6 Identify and describe AI-related security risks and mitigation techniques (e.g., AI use, sensitive data exposure, AI application access, AI-enabled threats) and explain how Palo Alto Networks platform capabilities can help discover, monitor, control, and secure them
NGFW and SASE Solution Maintenance and Configuration
- 4.1 Explain the configuration and maintenance of Palo Alto Networks hardware firewalls, VM-Series firewalls, CN-Series firewalls, and Cloud NGFWs (e.g., Security policies, profiles, updates, upgrades)
- 4.2 Explain the configuration and maintenance of Prisma Access (e.g., Security policies, profiles, updates, upgrades, monitoring and logging)
Infrastructure Management and CDSS
- 5.1 Explain the function of Security policies, profiles, and updates in the configuration and maintenance of CDSS
- 5.2 Explain the function of Security policies, Device-IDs, and monitoring and logging in the configuration and maintenance of IoT security
- 5.3 Explain the function of data encryption, access control, and monitoring and logging in the configuration and maintenance of Enterprise DLP and Enterprise SaaS Security
- 5.4 Explain the function of supported products, new device addition, reporting, and configuration management in SCM and Panorama in network security environments
Connectivity and Security
- 6.1 Explain the configuration and maintenance of network security for on-premises, cloud, and hybrid networks (e.g., network segmentation, policies, monitoring and logging, certificates)
- 6.2 Identify and describe the components used to maintain connectivity and security of remote users (e.g., remote access solutions, network segmentation, Security policy tuning, monitoring and logging, certificates)
On the day
The exam itself
Everything Palo Alto Networks publishes about sitting it, and nothing we inferred.
Prerequisites
No mandatory prerequisites — this certification has no required predecessor exam or credential.
CertificationPalo Alto Networks Certified Network Security Professional
Exam formatMultiple choice and performance-based
DeliveryPearson VUE
LanguagesEnglish
Certification levelProfessional
After you pass
Where this credential goes next
The path Palo Alto Networks lays out, how the credential is kept, and where to book.
Step-by-step path to Palo Alto Networks Certified Network Security Professional
Credential earnedPalo Alto Networks Certified Network Security Professional Professional level certification Lifecycle status
This certification is currently active and available. Palo Alto Networks maintains this certification to validate current skills and industry relevance.
Exam status: ActiveMaintained by Palo Alto Networks
Exam registration
Register for the exam through Pearson VUE, Palo Alto Networks’s authorized testing partner.
Schedule your examVisit the official Palo Alto Networks certification page for exam policies and requirements.
View the official pageYour coach
And when you are serious, your coach Pip takes over
Your coach in the app reads what you have answered with the book closed and tells you one thing to do tonight. It will not count an answer you gave with the page open, and it will tell you when you are not ready.
See how the coach worksBefore you book
Questions people ask
Is the Network Security Professional certification part of a larger certification path?
Yes, Palo Alto Networks offers a tiered certification program. The Network Security Professional is a Professional-level certification, and it may serve as a stepping stone to higher-level certifications such as the Network Security Architect.
What is the format of the Network Security Professional exam?
The exam includes multiple-choice questions and performance-based tasks that assess practical skills in deploying and managing Palo Alto Networks solutions.
How do I schedule the Network Security Professional exam?
You can schedule the exam through Pearson VUE, either online or at a test center. Visit the Palo Alto Networks certification page for a direct link to scheduling.
What identification do I need to bring to the exam?
You must present a valid government-issued photo ID that matches the name on your registration. For online proctored exams, you will also need to show your ID to the proctor.
Are there any hands-on labs in the Network Security Professional exam?
Yes, the exam includes performance-based questions that simulate real-world scenarios, requiring you to demonstrate practical skills in a simulated environment.
What job roles does the Network Security Professional certification align with?
This certification is designed for network security engineers, firewall administrators, and security operations professionals who manage Palo Alto Networks solutions.
Can I recertify by passing a higher-level exam?
Palo Alto Networks does not publish a specific recertification policy. Check the official certification handbook for the most current information.
Information freshness · Content last reviewed on 2026-07-30 Up to date
Practice free questions 540 questions, free, no account needed.
The curriculum
The whole exam, mapped and written
Every domain, every objective, and every concept Palo Alto Networks measures — each one written out.
6domains
22objectives
144concepts
117free pages
The domains, and what sits inside them
Every objective below is a page you can open and practise now, without an account.
The official Palo Alto Networks exam outline · checked 30 July 2026 · See the source
1Network Security Fundamentals104 questions
1.1 Explain Application Layer inspection for Strata and SASE products8 concepts · 6 pagesOpen →1.2 Explain the functionality of slow path and fast path for packet inspection7 concepts · 6 pagesOpen →1.3 Explain the use of decryption on Strata and SASE products (e.g., SSL Forward Proxy, SSL Inbound Inspection, SSH Proxy, no decrypt)9 concepts · 5 pagesOpen →1.4 Explain the application of network hardening methods for enhanced security on Strata and SASE products (e.g., Content-ID, Zero Trust, User-ID, Device-ID, Zones)7 concepts · 6 pagesOpen →
2NGFW and SASE Solution Functionality118 questions
2.1 Explain the function of Cloud NGFWs, PA-Series, CN-Series, and VM-Series firewalls (e.g., perimeter and core security, zone security and segmentation, high availability [HA], security and NAT policy implementation, monitoring and logging)10 concepts · 7 pagesOpen →2.2 Explain the function of Prisma SD-WAN (e.g., WAN optimization, path and NAT policies, Zone-based firewalls, monitoring and logging)5 concepts · 4 pagesOpen →2.3 Explain the function of Prisma Access (e.g., remote user configuration, remote network configuration, public and private application access, security and NAT policy implementation, monitoring and logging)8 concepts · 7 pagesOpen →2.4 Explain the functionality of Panorama and Strata Cloud Manager (SCM) for managing Strata and SASE solutions9 concepts · 7 pagesOpen →
3Platform Solutions, Services, and Tools156 questions
3.1 Explain the security efficacy of Palo Alto Networks NGFW and Prisma SASE products (e.g., security and NAT policy, User-ID, App-ID, decryption, monitoring and logging)5 concepts · 5 pagesOpen →3.2 Explain the functionality of Cloud-Delivered Security Services (CDSS) components7 concepts · 5 pagesOpen →3.3 Explain the alignment of AIOps to Palo Alto Networks best practices (e.g., dashboards, Best Practice Assessment [BPA], administration)4 concepts · 5 pagesOpen →3.4 Explain how Next-Generation Trust Security (NGTS) supports identity governance, trust relationships, and adaptive security decisions across the enterprise platform4 concepts · 5 pagesOpen →3.5 Identify and describe quantum security risks (e.g., harvest now, decrypt later attacks) and Palo Alto Networks platform capabilities to address them (e.g., post-quantum readiness, hybrid cryptography)7 concepts · 7 pagesOpen →3.6 Identify and describe AI-related security risks and mitigation techniques (e.g., AI use, sensitive data exposure, AI application access, AI-enabled threats) and explain how Palo Alto Networks platform capabilities can help discover, monitor, control, and secure them10 concepts · 6 pagesOpen →
4NGFW and SASE Solution Maintenance and Configuration34 questions
4.1 Explain the configuration and maintenance of Palo Alto Networks hardware firewalls, VM-Series firewalls, CN-Series firewalls, and Cloud NGFWs (e.g., Security policies, profiles, updates, upgrades)9 concepts · 6 pagesOpen →4.2 Explain the configuration and maintenance of Prisma Access (e.g., Security policies, profiles, updates, upgrades, monitoring and logging)4 concepts · 2 pagesOpen →
5Infrastructure Management and CDSS88 questions
5.1 Explain the function of Security policies, profiles, and updates in the configuration and maintenance of CDSS6 concepts · 4 pagesOpen →5.2 Explain the function of Security policies, Device-IDs, and monitoring and logging in the configuration and maintenance of IoT security5 concepts · 5 pagesOpen →5.3 Explain the function of data encryption, access control, and monitoring and logging in the configuration and maintenance of Enterprise DLP and Enterprise SaaS Security6 concepts · 6 pagesOpen →5.4 Explain the function of supported products, new device addition, reporting, and configuration management in SCM and Panorama in network security environments5 concepts · 4 pagesOpen →
6Connectivity and Security40 questions
6.1 Explain the configuration and maintenance of network security for on-premises, cloud, and hybrid networks (e.g., network segmentation, policies, monitoring and logging, certificates)4 concepts · 4 pagesOpen →6.2 Identify and describe the components used to maintain connectivity and security of remote users (e.g., remote access solutions, network segmentation, Security policy tuning, monitoring and logging, certificates)5 concepts · 5 pagesOpen →
Not a table of contents
Every line on this map already opens
In front of every objective the practice pages are already there, free and without an account. This is one objective, opened.
1.1 Explain Application Layer inspection for Strata and SASE products6 pagesOpen →
Free in front of it
29 questions on this objective, five to a page. Every range above is a real page, open now, with no account.
Reading the map is not the same as knowing the ground
The curriculum tells you what is on the exam. Proving you know it is a different job — and it is the one the closed-book run does.
Free questions
540 questions. No account, no card.
The whole bank is open. 5 questions to a page, every answer explained, and a discussion thread on each one.
540questions
117pages
22objectives
Freealways
Start anywhere1.1 Explain Application Layer inspection for Strata and SASE products 29 questions · 6 pages
Browse by domain
Every objective, and every page range, is a link — so you can pick up exactly where you left off.
1Network Security Fundamentals104 questions
2NGFW and SASE Solution Functionality118 questions
3Platform Solutions, Services, and Tools156 questions
4NGFW and SASE Solution Maintenance and Configuration34 questions
5Infrastructure Management and CDSS88 questions
What a practice page gives you
1Five to a page
Short enough to finish, long enough to matter.
2Every answer explained
Not only which one is right — why the others are wrong.
3A discussion on each
Ask, answer, and vote. Every question has its own thread.
A question, and the idea behind it
Every question comes from a concept
These are not trivia. Each one is written against a concept in the book, so when you get one wrong there is somewhere to go and find out why.
The visual book
See it once. Carry it into the exam.
The pages shown here come from our AI-900 book — an example of how each concept is written in plain language and, where the idea needs one, drawn as a full page you can take in at a glance.
144concepts
540free questions
Why a picture, and not another paragraph
Three reasons, and each one is a real finding rather than a slogan.
You can see it againThe whole idea at onceWhere it starts, what happens in the middle, what comes out, and the mistake to avoid.
Multimedia principle · MayerThe look-alikes sit togetherThe pairs the exam tests are drawn side by side, so the difference is seen, not told.
Dual coding · PaivioWhat one page is made of
You are never asked to read a poster here — only to see how one is built. After that, every other page is legible at a glance.
1A numbered strip on top
The idea as a sequence, followed with a finger before a word is read.
2Panels for the parts
What it is, how the machine learns it, when it is the right tool.
3The trap, framed
The distinction the exam tests, given its own box instead of buried in prose.
4One line at the bottom
The sentence to carry into the exam room.
Open book, on purpose
Answer it with the picture beside you
This is the part that teaches. The illustration and the written explanation stay where they are while you work, so a scenario stops being a memory test and becomes something you can simply look at.
It teaches · it does not count
A smartphone uses AI to unlock when the owner looks at the camera. Which AI capability is being used?
AImage classification
BFacial recognition
COptical character recognition
DObject detection
Look at the five steps. Detect finds a face, align straightens it, encode turns it into numbers, search compares it with a stored face, and decide answers one question: is this the same person? Classification would only say “a face”. Detection would only draw a box. Neither decides whose.
Then the page shuts, and it starts counting
The same questions come back with the book closed — that run is the one that counts. After it, your coach picks one thing for tonight, sized to the time you have, and brings pages back before you lose them.
Testing effect · Roediger & Karpicke 2006 · spacing effect · Cepeda et al. 2006
Official resources
Straight from Palo Alto Networks
Where the exam is defined, scheduled and scored.
4official links
144concepts mapped
The source
Palo Alto Networks’s own pages
We link to them rather than repeat them, so nothing here goes stale behind them.
Checked against the source
Every objective on the official Palo Alto Networks outline already has questions here
We build from the official skills outline, not from a summary of it — 22 objectives, 144 concepts written under them, and free questions against every one. When Palo Alto Networks changes the outline, this page changes with it.
22objectives on the outline→144concepts written→540free questions
An official page tells you what will be asked. It cannot tell you what you will get right.
That is the only question worth answering the night before, and no link answers it. You answer it by taking the questions with the book closed, and seeing what comes back.