Domain 1: Objects
- An address object can be defined as an IP netmask, a contiguous IP range, or a fully qualified domain name (FQDN); FQDN objects fit best when a hostname is stable but its backend IP addresses change.
- A service object bundles a protocol and port (for example TCP on a specific port) once so many rules can reference it; changing the object updates every rule that uses it.
- A snippet is a reusable configuration bundle (objects and other settings) that can be attached to multiple folders; an object inside it becomes available to every folder the snippet is assigned to without duplication.
- When a more specific folder defines an object with the same name as an inherited one, the more specific object takes precedence within that folder's branch.
- Static address groups support nesting, so a group can include other address groups as members; dynamic address groups use tags to determine membership.
- File Blocking rules are evaluated top-down and the first matching rule's action is used; the alert action lets a file transfer proceed while logging it for visibility and baselining.
- A WildFire Analysis profile is attached to a Security policy rule and forwards matching files to either the public cloud or a private cloud (WF-500) appliance for analysis.
- For an External Dynamic List (EDL), the source URL and list type are required; one entry per line is required and a leading pound (#) character marks a comment line.
- Command-and-control (C2) signatures identify traffic patterns that indicate a compromised host communicating with an attacker's infrastructure, and 'Known Malicious IP Addresses' is a vendor-supplied predefined feed.
- A Certificate Profile validates the HTTPS source server's certificate, and existing rules referencing predefined application objects keep working after a content update, automatically benefiting from updated signatures.
Domain 2: Policies
- Security policy is evaluated top-down on a first-match basis, and by default a rule logs the session at session end once the connection closes or times out.
- Rule shadowing occurs when a broader rule higher in the list matches first, making a more specific rule below it unreachable; the fix is usually to reorder so specific rules sit above general ones.
- Rule evaluation order across scopes is: centrally managed pre-rules first, locally created rules next, then centrally managed post-rules last.
- Zone types differ: a universal rule also matches same-zone (intrazone) traffic between its listed zones, while an interzone rule matches only sessions crossing between two different zones.
- A NAT rule's Original Packet section matches the untranslated packet on source zone, destination zone, and destination interface, while the translated address is set in the Translated Packet section.
- Source NAT types include Dynamic IP and Port (DIPP) and Dynamic IP; DIPP rewrites source IP and port so many internal hosts share one external address (typical internet access).
- Bi-directional translation on a Static IP NAT rule is an option the administrator must turn on; it is not enabled by default.
- Security profiles only inspect sessions that a rule permits, because Content-ID inspection never runs on traffic a Security rule denies.
- Authentication policy establishes a verified User-ID mapping (via Authentication Portal, and can chain factors including MFA) so subsequent group-based Security rules match correctly.
- The Reset-server action sends a TCP reset only to the server endpoint, and QoS policy independently controls a permitted session's bandwidth and priority; run Policy Optimizer as a recurring process.
Domain 3: Strata Cloud Manager Operations
- Strata Cloud Manager (SCM) centrally manages next-generation firewalls (hardware, VM-Series, and cloud) and Prisma Access from one place, while managed firewalls still enforce policy on their own data plane.
- A firewall is onboarded to SCM either through direct cloud onboarding or through an integrated Panorama deployment; Panorama can keep managing devices on-premises while connected to SCM for shared visibility.
- Folders provide the hierarchical structure that organizes and scopes configuration; a device must be associated with a folder before it can inherit that folder's configuration.
- Configuration inheritance flows downward from parent folders to children, and a device's effective configuration is built by inheriting through every ancestor, with more specific settings overriding more general ones.
- A snippet can be attached to multiple folders at once, and the order or priority in which snippets are attached to a folder determines how their contributed rules combine.
- Before a push, confirm the correct scope, review validation results, and account for concurrent administrator activity, since overlapping edits can conflict; the pending push summary shows exactly what will change.
- Strata Logging Service is the renamed cloud log repository; firewalls forwarding logs to it can still duplicate those logs to other external destinations.
- A Best Practice Assessment commonly scores decryption coverage, App-ID and security profile usage, and logging configuration; rules that allow SSL/TLS without a matching decryption policy lower the decryption score.
- Log types map to activity: URL Filtering logs record the category and enforcement action for a visited site, and Data Filtering logs record matches against sensitive data patterns in transferred content.
- Maintaining configuration backups and tracking version history are the practices that support reliable rollback after a problematic change; reviewing push job details surfaces the specific errors that need correcting.
Domain 4: Troubleshooting
- Security policy uses first-match, top-down evaluation, and the entire matched rule's configuration (including its security profiles) applies, so an early permissive rule with no threat profile leaves matching traffic uninspected.
- The Action and Rule fields are the first two traffic-log fields to check when identifying why a session was blocked, and 'reset-both' means the firewall reset the connection on both the client and server sides.
- The 'aged-out' session-end reason reflects an idle-timeout expiration, not an explicit policy denial, while 'not-applicable' means the session was denied before App-ID could evaluate the application.
- test security-policy-match and test nat-policy-match simulate policy outcomes for a hypothetical flow without sending real traffic.
- show session id reveals a session's ingress and egress zones and any NAT translation applied, show session all with filter criteria limits output to matching sessions, and show arp all confirms whether a next hop's Layer 2 (MAC) address resolved.
- A decrypted session can still fail despite an allow rule when the server certificate is expired (blocked by the decryption profile) or the negotiated cipher suite is unsupported, since decryption applies its own checks.
- A missing Log Forwarding profile on a rule explains why logs stay local instead of reaching the centralized service, and firewalls buffer recent logs locally during a logging-service outage and forward them once connectivity returns.
- application-default restricts a rule to each application's standard ports, so traffic on a non-standard port will not match that rule; place more specific rules above more general ones.
- Repeated flapping between connected and disconnected states usually points to an intermittent management-plane network path rather than a data-plane problem.
- A dashboard widget can show no data for an active firewall because its scope filter or selected time range excludes that device, or because a recently onboarded device has not yet generated enough log volume.
Palo Alto Network Security Analyst exam tips
- When a question describes traffic being allowed but uninspected, look for a permissive first-match rule above the intended rule; remember the whole matched rule's profile set applies and evaluation then stops.
- For NAT questions, separate the two halves of a rule: match on the Original Packet (pre-translation zones and interface) and rewrite in the Translated Packet section; recall that Static NAT bi-directional is off by default.
- Memorize the SCM rule order pre-rules, local rules, post-rules, and that inheritance flows parent-to-child with the most specific setting winning, since scope questions hinge on both.
- Know your CLI: test security-policy-match and test nat-policy-match simulate flows, while show session id, show session all, and show arp all inspect live state.
- Map log symptoms to causes: local-only logs point to a missing Log Forwarding profile, empty widgets point to scope or time-range filters, and aged-out or not-applicable are session-end reasons, not denials.
Study guide FAQ
What does the NetSec-Analyst exam focus on?
It focuses on day-to-day operation of Palo Alto Networks next-generation firewalls managed through Strata Cloud Manager: building objects, writing and evaluating Security and NAT policy, running SCM operations and reporting, and troubleshooting traffic, policy, and management issues.
How long is the exam and what score do I need to pass?
The exam runs 90 minutes. Palo Alto Networks sets the passing score at 860 on a 300-to-1000 scale for every one of its certification exams. Expect broad coverage across all four domains rather than deep focus on one area.
Do I need hands-on Strata Cloud Manager experience?
Yes. Many items test SCM specifics such as folder inheritance, snippets, push scope and validation, and Strata Logging Service, so practical familiarity with the SCM console and its deployment workflow is strongly recommended.
How much CLI troubleshooting is tested?
A meaningful portion. You should be comfortable interpreting traffic-log fields and session-end reasons and using commands like test security-policy-match, test nat-policy-match, show session id, show session all, and show arp all to diagnose issues.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- Palo Alto Networks - Network Security Analyst datasheetlink and content verified 8 September 2026Four domains totalling 100% at the weights used by CertGrid practice exams - 30/30/26/14. Palo Alto's domain names are longer than ours: "Object Configuration Creation and Application" and "Policy Creation and Application" where we say Objects and Policies; Management and Operations and Troubleshooting match.
- Palo Alto Networks - certification handbooklink and content verified 8 September 2026"For ALL Palo Alto Networks Certification exams, the converted raw passing score is 860 on a scale of 300 to 1000." That single sentence settles the pass mark for all seven guides, and it is why five of them no longer say "a scaled passing score of 700" - 700 is CertGrid's own grading threshold, never Palo Alto's. The handbook also explains why the figure is scaled: cut scores are set per exam form by the Certification Committee, and scaling absorbs the difficulty variation between forms.
The vendor does not publish this. Palo Alto publishes neither an item count nor an exam length on its certification pages, in the datasheets or in the handbook - the handbook sends candidates to Pearson VUE for the appointment time, and notes that the time shown there is the whole appointment, including reading the candidate agreement, rather than answering time. So the 90 minutes on this guide is unverified from Palo Alto's own documents, and the question count is already shown as "Varies" rather than as a Palo Alto figure.