Test / Eksamen: Palo Alto Networks: Next Generation Firewall Engineer (PAN-S-NGFE)

The Palo Alto Networks Certified Next-Generation Firewall (NGFW) Engineer certification validates the knowledge and skill of experienced NGFW engineers in the areas of deployment configuration, post-deployment management and configuration, integrations with other tools, and their ability to participate in troubleshooting deployed environments. The certification also validates pre-deployment planning of Palo Alto Networks NGFW component solutions and an understanding of their architecture to achieve network transformation outcomes.

The purpose of this document is to help you prepare for the exam and attain the certification. Please note that this document is intended to help identify the topics covered and to provide resources and references for understanding those topics. It is not intended to be used as the sole document to prepare for the Next-Generation Firewall Engineer exam.

Exam Details:

Duration: 90 minutes

Format: Multiple-choice questions

Language: English

Target Audience

This exam is designed for security professionals responsible for installing / deploying, operating, and administering the Palo Alto Networks suite of NGFW products.

1. PAN-OS Networking Configuration 38%

1.1 Configure interface

1.1.1 Layer 2

1.1.2 Layer 3

1.1.3 Virtual wire

1.1.4 Tunnel interfaces

1.1.5 Aggregate Ethernet (AE)

1.1.6 Management

1.2 Configure zones

1.3 Configure high availability (HA)

1.3.1 Active/active

1.3.2 Active/passive

1.3.3 Link and path monitoring

1.4 Configure routing

1.4.1 Dynamic routing protocols

1.4.2 Redistribution and policies

1.4.3 Route monitoring

1.4.4 Advanced Routing Engine

1.5 Configure GlobalProtect

1.5.1 Portals

1.5.2 Gateways

1.5.3 Authentication

1.5.4 Split tunneling

1.6 Configure tunnels

1.6.1 IPSec

1.6.2 Quantum-resistant cryptography

1.6.3 Generic Routing Encapsulation (GRE)

2. PAN-OS Device Setting Configuration 38%

2.1 Implement authentication roles, profiles, and sequences

2.2 Configure virtual systems (VSYS)

2.2.1 Interfaces and zones

2.2.2 Virtual routers

2.2.3 Logical routers

2.2.4 Inter-VSYS routing and security

2.3 Configure logging

2.3.1 Strata Logging Service

2.3.2 Log forwarding

2.3.3 Log collectors and log collector groups

2.4 Implement PAN-OS software updates

2.5 Configure certificates

2.5.1 PKI integration

2.5.2 Authentication

2.5.3 SLS/TLS profiles

2.5.4 Decryption (e.g., subordinate CA, forward trust/untrust)

2.5.5 Certificate profiles

2.6 Configure on-premises and Cloud Identity Engine User-ID

2.6.1 Group mapping and directory sync

2.6.2 User-to-IP mapping and user context

2.6.3 Redistribution and segments

2.7 Configure web proxy on PAN-OS

3. Integration and Automation 24%

3.1 Install the selected deployment option

3.1.1 PA-Series

3.1.2 VM-Series

3.1.3 CN-Series

3.1.4 Cloud NGFW

3.1.5 AI Runtime Security

3.2 Use APIs to automate deployment

3.3 Manage third-party services to deploy NGFWs (e.g., Kubernetes, hypervisors, CSPs,

Terraform, Ansible)

3.4 Use on-premises centralized management

3.4.1 Panorama

3.4.2 Templates and device groups

3.4.3 Pre- and post-ruleset

3.5 Build Application Command Center (ACC) dashboards and custom reports

- Cybersecurity Apprentice

- Cybersecurity Practitioner

- Network Security Generalist