Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Palo Alto Networks
Exam Format
Registration
Validity
Skills this practice test covers
- Design least-privilege Security policy from User-ID, HIP checks and Device-ID.
- Architect Panorama, Strata Cloud Manager and Cloud Identity Engine with high availability.
- Choose on-ramp and off-ramp designs that connect Prisma Access to private applications.
- Match each group of mobile users to Prisma Browser, Prisma Access Agent, explicit proxy or GlobalProtect.
- Place IoT sensors and design Device Security from discovery to enforcement.
- Size VM-Series firewalls on hypervisors and weigh SSL decryption against performance.
Explore related topics
NetSec-Architect exam content
10 domains · 48 topics · 250 questions
Zero Trust Enterprise8%20 questions
This domain applies Zero Trust to network design: least-privilege access, segmentation, and constant inspection of the traffic that is allowed. Policy rests on who the user is, the state of the device and the application in use.
Skills tested
- Build least-privilege Security policy from User-ID, HIP and security posture, and Device-ID.
- Tell network segmentation from microsegmentation and choose where each one fits.
- Limit access to specific applications instead of whole network segments.
- Scan allowed traffic continuously to stop malware and exploits.
- Plan continuous monitoring and analytics for a Zero Trust environment.
Questions by topic
- Least Privilege Access Controls5
- Network Segmentation5
- Continuous Security5
- Monitoring and Analytics5
AI Security11%30 questions
AI applications, models and data need protection of their own. Candidates tell apart the parts of Prisma AI Runtime Security (AIRS) and AI Access, choose a standard AI security architecture, and apply controls to AI applications by class.
Skills tested
- Differentiate the products that make up Prisma AIRS and AI Access.
- Describe the AIRS components and how they integrate with Kubernetes.
- Recommend a standard architecture that protects AI content and data.
- Classify AI applications by their attributes, then sanction them and apply DLP.
Questions by topic
- Prisma AIRS and AI Access11
- AI Security Architectures5
- AI Application Security Controls9
- AI Compliance and Controls5
Centralized Management and IAM13%33 questions
The largest domain covers the management and identity layer that the other designs depend on. Candidates architect Panorama and log collectors, plan Strata Cloud Manager and Strata Logging Service, and decide how Cloud Identity Engine syncs and authenticates users.
Skills tested
- Architect Panorama and its log collectors with HA and redundancy.
- Design Strata Cloud Manager (SCM), Strata Logging Service and Cloud Identity Engine together.
- Recommend Cloud Identity Engine directory sync options and Strata Logging Service log forwarding methods.
- Choose user identification and authentication methods for NGFW, Prisma Access and Prisma SD-WAN.
Questions by topic
- Panorama and Logging2
- Cloud Management7
- Identity Integration7
- Log Forwarding5
- Cloud Identity Engine Use Cases3
- Panorama Architecture6
- User Identification and Authentication2
- Cloud Identity Engine Directory Sync1
SSE Private Application Access11%28 questions
SSE means security service edge. It is the set of cloud-delivered security services inside SASE. This domain asks how Prisma Access reaches private applications: through regional or global deployments, on-ramp and off-ramp connections, or Prisma Browser.
Skills tested
- Architect Prisma Access in regional and global deployments.
- Differentiate on-ramp and off-ramp designs, including service connection routing and ZTNA connectors.
- Decide where Colo-Connect and Google Cloud NCC fit among the on-ramp and off-ramp options.
- Determine when Prisma Browser should provide private application access.
Questions by topic
- Prisma Access Deployments6
- On-Ramp and Off-Ramp Architectures6
- ZTNA and Connectivity12
- Private Application Access via Prisma Browser4
Mobile User Security7%16 questions
Remote users can reach Prisma Access in several ways, and this domain asks which way suits each case. Candidates also design GlobalProtect connection methods and Prisma Access Mobile Users, and plan AI-Powered Autonomous Digital Experience Manager (ADEM).
Skills tested
- Evaluate Prisma Browser, Prisma Access Agent, explicit proxy and GlobalProtect for a user group.
- Choose between the On-demand, User-logon (Always On) and Pre-logon (Always On) connection methods.
- Architect Prisma Access Mobile Users for a distributed workforce.
- Design ADEM to measure the digital experience of mobile users.
Questions by topic
- GlobalProtect Connection Methods5
- AI-Powered ADEM5
- Mobile User Access Methods4
- Mobile Access Solutions2
Modernizing Branches11%26 questions
This domain is about moving branch offices to SASE. Candidates compare and design branch architectures for security and high availability, and evaluate the advanced security that Prisma SD-WAN provides.
Skills tested
- Compare branch architecture options for SASE security.
- Design branch high availability so that security continues when a device or link fails.
- Evaluate the advanced security features of Prisma SD-WAN.
Questions by topic
- Branch SASE Architectures21
- SD-WAN Security2
- Advanced Security for Prisma SD-WAN3
Data Security7%20 questions
This domain is about protecting data in SaaS applications and wherever Enterprise DLP can inspect it. Candidates must know when SaaS Security Inline fits and when SaaS API Security fits, and how each DLP detection method works.
Skills tested
- Differentiate SaaS Security Inline from SaaS API Security.
- Choose the most secure approach to control SaaS application usage.
- Explain the Enterprise DLP methods: classifiers, EDM, IDM, OCR and ML classification.
- Decide where Endpoint DLP and policy-based DLP fit in a design.
Questions by topic
- SaaS Security10
- Enterprise DLP9
- SaaS Application Control1
Securing IoT Environments11%26 questions
Device Security protects IoT devices: it finds them, assesses their risk and enforces policy on them. Candidates also decide where IoT sensors go and which platform supplies visibility.
Skills tested
- Architect Device Security with visibility, discovery, risk assessment and enforcement.
- Compare the IoT sensor placement options.
- Explain visibility across NGFW, the virtual metadata collector, Prisma SD-WAN and PAN-OS SD-WAN.
- Evaluate Device-ID capabilities and design policy around them.
Questions by topic
- Device Security Architecture12
- Visibility Functionality6
- Architect Device Security5
- IoT Sensor Placement1
- Device-ID Capabilities2
Public Cloud11%26 questions
Firewalls in AWS, Azure, GCP and OCI are the subject here. Each cloud has its own insertion options and high availability design, and candidates must justify VM-Series or Cloud NGFW for a use case.
Skills tested
- Explain the standard NGFW integrations with AWS, Azure, GCP and OCI.
- Design to AWS NGFW standards, including insertion options, HA and subinterfaces.
- Design to the Azure and GCP NGFW standards for insertion and HA.
- Plan maintenance and security across cloud service provider (CSP) environments.
- Justify VM-Series or Cloud NGFW from the use case.
Official topics
- NGFW Cloud Integrations
- Cloud Maintenance and Security
- AWS NGFW Standards
- Azure NGFW Standards
- GCP NGFW Standards
- VM-Series vs Cloud NGFW
Private Cloud (PA-Series, VM-Series, Hypervisors)10%25 questions
This domain covers firewalls for data centers and private clouds, from PA-Series hardware to VM-Series on hypervisors. Candidates plan capacity, size SSL inspection, design high availability, and set routing for Layer 3 deployments.
Skills tested
- Assess scope and capacity for edge, core and east-west microsegmentation.
- Size VM-Series on a hypervisor with vCPU sizing, hardware offload, DPDK and SR-IOV.
- Choose active/passive, active/active, hardware clustering, HSF or fast failover for resilience.
- Explain ECMP, static routing, BGP and OSPF choices for a Layer 3 deployment.
- Weigh SSL decryption against performance and size SSL inspection to match.
Questions by topic
- Design VM-Series deployments across hypervisors10
- Architect HA deployment for private cloud resilience4
- Evaluate SSL decryption versus performance trade-offs2
- Private Cloud Capacity Planning4
- Systems Management1
- VM-Series Hypervisor Deployments3
- HA Deployment for Private Cloud1
Requirements
- No formal prerequisites: Palo Alto Networks lists recommended experience only.
- Recommended: five or more years designing, deploying and troubleshooting security and networking in SASE, branch, private cloud and public cloud environments.
- Recommended: two or more years with Palo Alto Networks architecture and solutions.
About the NetSec-Architect exam
Palo Alto Networks built NetSec-Architect for engineers who design network security across SASE (secure access service edge), branch offices, private clouds and public clouds. Most of its objectives begin with design, architect, recommend or evaluate, so its questions ask which design best meets a stated need. Palo Alto Networks recommends five or more years of design work in these environments and two or more years with its own products. Passing earns the Palo Alto Networks Certified Network Security Architect certification.
The PlanetCert practice test gives the most questions to Centralized Management and IAM, which is also the largest domain on the exam. Its explanations compare the options in each scenario, such as a zero trust network access (ZTNA) connector against a service connection, or VM-Series against Cloud NGFW. Study Mode suits the Public Cloud domain, where AWS, Azure and GCP each have their own insertion options and high availability designs. Brainy AI Assistant can explain unfamiliar products such as Prisma AI Runtime Security (AIRS) and Prisma Browser, then ask a new question about each one.
How to earn the certification
- Earns
- Palo Alto Networks Certified Network Security ArchitectArchitect
The certification is valid for two years.
- Before
- NetSec-Pro Palo Alto Networks Certified Network Security Professional
The professional-level certification on the typical path to the architect level.
- NetSec-Analyst Palo Alto Networks Certified Network Security Analyst
A network security certification that usually comes before the architect level.
- PCNSE Network Security Engineer
The engineer-level certification for PAN-OS firewalls and Panorama, usually earned first.
- sse-engineer Security Service Edge Engineer
The engineer-level certification for Prisma Access, whose SASE topics several domains here design around.
- NetSec-Pro Palo Alto Networks Certified Network Security Professional
How to prepare for NetSec-Architect
- 1
Map every domain to its products
List the products each domain names, from Prisma AIRS and Strata Cloud Manager to Prisma SD-WAN and Cloud NGFW. Next to each one, write what it protects and where it sits in a design.
- 2
Design identity and management first
Centralized Management and IAM is the largest domain. Sketch Panorama with log collectors in HA, then Strata Cloud Manager with Strata Logging Service, and decide how Cloud Identity Engine syncs the directory.
- 3
Draw one SASE design end to end
Connect mobile users, a branch and a data center to Prisma Access on paper. Mark every on-ramp and off-ramp, the GlobalProtect connection method, and the place of each ZTNA connector.
- 4
Tabulate the cloud firewall choices
Build a table of insertion options and high availability for AWS, Azure and GCP. Add when VM-Series fits better than Cloud NGFW, and how SSL decryption changes firewall sizing in a private cloud.
- 5
Defend each design under time
Take the NetSec-Architect practice test in Study Mode one domain at a time. Then run it in Timed Mode, and ask Brainy AI Assistant why each rejected design was the weaker choice.
Start a timed NetSec-Architectrun
Palo Alto Networks publishes a Network Security Architect learning path, with recommended courses on Prisma Access, VM-Series and Prisma SD-WAN.
Who NetSec-Architect is for
- Senior network security engineers who design Palo Alto Networks deployments across several environments.
- Security architects who plan SASE, branch and cloud security for a large organization.
- Holders of PCNSE or Network Security Professional who are moving from configuration into design.
Typical job titles: Network security architect · Security architect · Cloud security architect · SASE architect · Principal network engineer
NetSec-Architect glossary
20 terms from the exam objectives and the vendor's official material, each defined in a sentence.
- Autonomous Digital Experience Manager (ADEM)
- A service that measures application and network performance from the user's device, so that experience problems can be found and fixed.
- Cloud Identity Engine
- A cloud service that syncs users and groups from directories such as Entra ID or Okta and handles authentication for Palo Alto Networks products.
- Cloud NGFW
- A next-generation firewall that Palo Alto Networks runs as a managed cloud service, so the customer does not deploy firewall virtual machines.
- Device-ID
- A feature that identifies the device behind traffic, so policy can match a device type instead of only an IP address.
- DPDK
- Data Plane Development Kit: a software library that speeds up packet processing for a firewall that runs as a virtual machine.
- EDM
- Exact data matching: a DLP method that finds copies of specific sensitive records by comparing content against a fingerprint of the source data.
- Host information profile (HIP)
- Data that GlobalProtect collects about an endpoint's security state, which Security policy can check before it allows access.
- IDM
- Indexed document matching: a DLP method that detects sensitive documents, or parts of them, from an index of sample files.
- Microsegmentation
- Splitting a network into very small zones, down to single workloads, so that traffic between them can be inspected and controlled.
- Panorama
- The management server, physical or virtual, that pushes policy to many Palo Alto Networks firewalls and gathers their logs.
- Pre-logon (Always On)
- A GlobalProtect connection method that connects the device before the user signs in, so it stays protected and managed from startup.
- Prisma Access
- Palo Alto Networks' cloud-delivered security service for mobile users, branch offices and access to private applications.
- SaaS API Security
- Protection that connects to a SaaS application's API to scan data already stored in it, without sitting in the traffic path.
- SaaS Security Inline
- Inspection of SaaS traffic as it passes through an NGFW or Prisma Access, used to control which SaaS apps and actions are allowed.
- SR-IOV
- Single root I/O virtualization: a way to give a virtual machine direct access to a physical network card for higher throughput.
- Strata Cloud Manager (SCM)
- Palo Alto Networks' cloud-based console for managing and monitoring NGFWs and Prisma Access in one place.
- Strata Logging Service
- The Palo Alto Networks cloud service that stores and forwards logs from firewalls and Prisma Access.
- User-ID
- The PAN-OS feature that links traffic to a named user or group, so Security policy can be written per user.
- VM-Series
- The Palo Alto Networks NGFW in virtual machine form, for hypervisors in private clouds and for public clouds.
- ZTNA Connectors
- Small virtual machines placed near private applications that let Prisma Access reach those applications for zero trust network access.