Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Palo Alto Networks
Exam Format
90 min
60-70
70%
Specialist
Registration
$250 USD
Pearson VUE or online proctoring
English
Validity
2 years
Pass the recertification exam; Earn continuing education credits; Pass a higher-level certification exam
NGFW-ENGINEER Exam Topics and Domains
NGFW-ENGINEER is organized into 3 weighted domains. Expect to work with PAN-OS, Panorama, GlobalProtect, Cloud Identity Engine, and more.
1
PAN-OS Networking Configuration
38%
Configure interface
Layer 2Layer 3Virtual wireTunnel interfacesAggregate Ethernet (AE)Management
- Configure and manage different interface types in PAN-OS
- Implement appropriate interface modes for various deployment scenarios
- Configure interface-level security and management features
Configure zones
Zone configuration
- Create and configure security zones
- Apply zone protection profiles
- Configure inter-zone security policies
Configure high availability (HA)
Active/activeActive/passiveLink and path monitoring
- Design and implement high availability solutions
- Configure HA monitoring and failover mechanisms
- Troubleshoot HA issues and synchronization problems
Configure routing
Dynamic routing protocolsRedistribution and policiesRoute monitoringAdvanced Routing Engine
- Configure and manage dynamic routing protocols
- Implement route redistribution and filtering
- Configure advanced routing features
Configure GlobalProtect
PortalsGatewaysAuthenticationSplit tunneling
- Deploy and configure GlobalProtect infrastructure
- Implement secure remote access solutions
- Configure authentication and split tunneling
Configure tunnels
IPSecQuantum-resistant cryptographyGeneric Routing Encapsulation (GRE)
- Configure site-to-site VPN tunnels
- Implement quantum-resistant cryptography
- Deploy GRE tunnels for various use cases
2
PAN-OS Device Setting Configuration
40%
Implement authentication roles, profiles, and sequences
Authentication configuration
- Configure administrative roles and permissions
- Implement authentication profiles and sequences
- Apply role-based access control
Configure virtual systems (VSYS)
Interfaces and zonesVirtual routersLogical routersInter-VSYS routing and security
- Deploy and manage virtual systems
- Configure inter-VSYS communication
- Implement multi-tenancy solutions
Configure logging
Strata Logging ServiceLog forwardingLog collectors and log collector groups
- Configure comprehensive logging solutions
- Implement log forwarding and retention
- Deploy centralized log management
Implement PAN-OS software updates
Software updates
- Plan and execute software updates
- Manage content and dynamic updates
- Troubleshoot update issues
Configure certificates
PKI integrationAuthenticationSSL/TLS profilesDecryptionCertificate profiles
- Implement PKI infrastructure
- Configure SSL/TLS decryption
- Manage certificates and profiles
Configure on-premises and Cloud Identity Engine User-ID
Group mapping and directory syncUser-to-IP mapping and user contextRedistribution and segments
- Deploy User-ID infrastructure
- Configure Cloud Identity Engine
- Implement user-based security policies
Configure web proxy on PAN-OS
Web proxy configuration
- Configure web proxy functionality
- Implement proxy authentication
- Deploy proxy auto-configuration
3
Integration and Automation
22%
Install the selected deployment option
PA-SeriesVM-SeriesCN-SeriesCloud NGFWAI Runtime Security
- Deploy various firewall form factors
- Implement cloud-native security solutions
- Configure container and AI security
Use APIs to automate deployment
API automation
- Leverage APIs for automation
- Create automation scripts
- Implement programmatic configuration
Manage third-party services to deploy NGFWs
Third-party integration
- Deploy firewalls using IaC tools
- Integrate with orchestration platforms
- Automate deployment workflows
Use on-premises centralized management
PanoramaTemplates and device groupsPre- and post-ruleset
- Deploy and manage Panorama
- Design template and device group hierarchies
- Implement centralized policy management
Build Application Command Center (ACC) dashboards and custom reports
ACC and reporting
- Create custom dashboards
- Design and schedule reports
- Analyze security metrics
How do I earn this certification?
Passing NGFW-ENGINEER earns the Next-Generation Firewall Engineer certification. It sits in the Network Security track.
Current Level Exams
Next Level Options
Alternative Paths
- XSIAM-Engineer - XSIAM EngineerSOC and security operations focus
- CloudSec-Professional - Cloud Security ProfessionalCloud security platform expertise
- XDR-Engineer - XDR EngineerDetection and response capabilities
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
The most effective way to prepare for NGFW-ENGINEER is by using the PlanetCert Simulator to practice questions and review detailed explanations.
What's changed on this exam?
Current Status
- ACTIVE
- Last content update: 2024-08-01
- Announcement date: 2023-10-15
Updates
- PAN-OS 11.1 Core platform for all NGFW operations • Release date: 2023-11-01
- Panorama 11.1 Centralized management platform heavily tested • Release date: 2023-11-01
- VM-Series 11.1 Software firewall deployment scenarios • Release date: 2023-11-01
- Hardware Platforms Hardware-specific deployment and management
Who should take this exam?
This exam is typically taken by Network engineers and Security engineers.
- Experience with PAN-OS configuration and management
- Knowledge of network security concepts
- Familiarity with firewall deployment scenarios
- Understanding of routing and switching