Domain 1: PAN-OS Networking Configuration
- A Layer3 interface participates in policy and routing only when it is assigned both a security zone and a virtual router; missing either breaks matching or forwarding.
- In BGP best-path selection, once all higher attributes tie, the path from the router with the lowest router ID wins, and the router ID also uniquely identifies the BGP speaker.
- AS-path prepending artificially lengthens the AS-path so neighboring autonomous systems are less likely to prefer that route, steering inbound traffic to a shorter alternate path.
- PAN-OS conditional advertisement with a non-exist filter advertises a backup route only when a monitored (tracked) route is absent from the routing table, enabling failover advertising.
- OSPF adjacency on broadcast links fails when interface subnet masks disagree, because mismatched masks put the neighbors on different logical subnets; Exstart is where neighbors negotiate master/slave before exchanging DBD packets.
- Manually setting the OSPF or BGP router ID gives stability that automatic address-based selection does not guarantee, and OSPF graceful restart lets a restarting router keep its learned routes valid during the outage.
- LACP system priority uses lower-value-equals-higher-priority, so lowering the number increases a device's aggregation priority; a duplex mismatch produces errors and reduced throughput.
- A packet with no matching route and no configured default route is dropped for lack of a route to its destination.
- A tap zone only receives a passively mirrored copy of traffic and therefore cannot block, while bump-in-the-wire (virtual wire) inspects and enforces policy while staying invisible to neighboring L3 devices with no IP or routing changes.
- GRE does not encrypt its payload by default and must be paired with IPSec for confidentiality; GlobalProtect can authenticate via RADIUS, LDAP, or SAML and supports split tunneling scoped by access-route subnets, domains, or applications.
- An interface management profile controls which management services (such as HTTPS or ping) and source addresses can reach the firewall on that interface, and active/passive HA relies on the HA1 control link and HA2 data link.
Domain 2: PAN-OS Device Setting Configuration
- An authentication profile defines how credentials are verified (Local, RADIUS, TACACS+, LDAP, Kerberos, or SAML), while an authentication sequence tries each listed profile in order until one succeeds.
- Generating a certificate creates a new key pair and certificate locally on the firewall, whereas importing brings in an externally produced certificate and optionally its key pair; OCSP checks revocation with a real-time query for one specific certificate.
- WebUI HTTPS access is secured by an SSL/TLS certificate assigned to the management interface, and client-certificate authentication for the WebUI is enabled by applying a certificate profile in the management authentication settings.
- Without Terminal Services (TS) agent port mapping, every session on a shared Remote Desktop Services host appears to the firewall as one source IP, so User-ID cannot distinguish individual users.
- DNS Proxy rules are evaluated top-down and the first matching domain rule handles the query; static FQDN-to-IP entries are answered directly and take precedence over cached or forwarded records.
- DNS Security categories accept actions of alert, allow, block, or sinkhole, where sinkhole substitutes a controlled IP for the resolution instead of blocking the query outright.
- Log storage quotas allocate a percentage of finite local disk to each log type (such as Traffic or Threat) so one high-volume type cannot crowd out others and shorten retention.
- The System log records system-level events such as HA state changes and certificate-expiration warnings, and PAN-OS can schedule automatic content updates to check, download, and install new releases on a recurrence.
- A Log Forwarding profile match-list entry can add or remove a tag on a source or destination address or a source user, feeding Dynamic Address Groups and Dynamic User Groups for automated response.
- An HTTP Server Profile forwards logs as customizable HTTP requests to third-party systems, while an Email Server Profile requires an SMTP server address plus sender and recipient addresses.
- The default predefined admin account holds the Superuser dynamic role (not Device Administrator); a Virtual System Administrator (Read Only) role is view-only within its assigned vsys and generally cannot create or edit Shared objects.
Domain 3: Integration and Automation
- Firewalls are added to Panorama by serial number on the Managed Devices page, after which each firewall or vsys is assigned to exactly one device group plus templates and a Collector Group.
- Templates and template stacks centrally manage network and device settings (interfaces, zones, virtual routers), while device groups manage policy and objects; a rule in the Shared location applies to every device group in the hierarchy.
- Moving a device group to a new parent changes which parent-level rules and objects its firewalls inherit, so hierarchy placement directly drives rule inheritance.
- A commit that is not scoped by an admin or location filter can also include other administrators' pending candidate changes, which is why partial or filtered commits matter in multi-admin environments.
- init-cfg.txt in a bootstrap package supplies day-0 settings such as hostname, IP, gateway, DNS, and the Panorama server address that a VM-Series firewall reads on first boot; full day-1 policy lives in bundle files.
- Panorama supports active/passive HA between two management servers, synchronizing device groups, templates, and managed-device information between peers, with one peer active and the other ready to take over.
- PAN-OS REST API endpoints embed a version identifier so requests align with a specific release's object schema and feature set, and interface management profiles govern which services and source addresses can reach the API.
- In the XML API, a get action returns configuration data without altering it, a success status means the request completed with any data in the response body, and log queries run as jobs polled by a returned job ID.
- The target parameter identifies which managed firewall a Panorama-issued API request is directed to, and Panorama can retrieve and deploy license or subscription activations to managed firewalls.
- A Log Collector receives and stores logs forwarded by managed firewalls, and Log Forwarding profiles can auto-tag a session's source or destination address for downstream dynamic grouping.
- The VM-Series firewall runs on supported public clouds and hypervisors, on AWS commonly as an Auto Scaling group behind a Gateway Load Balancer or a standalone Marketplace-AMI EC2 instance; terraform plan previews changes without applying them.
Palo Alto NGFW Engineer exam tips
- Treat every question as a hands-on config scenario: know the exact GUI path and object dependencies (zone plus virtual router on an interface, certificate profile in management settings) rather than just the concept name.
- Memorize the low-value-wins conventions that trip candidates up: lowest router ID wins BGP ties, lower LACP system priority means higher priority, and OSPF mask mismatches block adjacency.
- Be able to distinguish look-alike actions and objects quickly: generate vs import certificates, sinkhole vs block in DNS Security, tap (passive) vs virtual wire (inline) zones, and static vs forwarded DNS Proxy entries.
- For Panorama and automation items, keep the hierarchy straight: templates carry network/device settings, device groups carry policy/objects, Shared applies everywhere, and each firewall or vsys maps to exactly one device group.
- The exam is 90 minutes for a large pool, so pace yourself and flag configuration edge cases (multi-admin commits, HA link roles, User-ID on shared hosts) for review instead of stalling.
Study guide FAQ
What experience does the NGFW-Engineer exam assume?
It targets experienced firewall engineers who already deploy and operate PAN-OS next-generation firewalls, so it expects real hands-on configuration skill across networking, device settings, and Panorama or API automation rather than introductory knowledge.
What is the passing score and exam length?
Palo Alto Networks sets the passing score at 860 on a 300-to-1000 scale for every one of its certification exams, and this one runs for 90 minutes. Expect scenario-based configuration questions across all three domains.
Which domain carries the most weight?
PAN-OS Networking Configuration is the largest area, closely followed by Device Setting Configuration, with Integration and Automation the smallest of the three. Prioritize interfaces, routing, HA, certificates, User-ID, and Panorama fundamentals.
Do I need to know Panorama, APIs, and tools like Terraform and Ansible?
Yes. The Integration and Automation domain covers Panorama device groups, templates, and HA, the REST and XML APIs, VM-Series cloud deployment, and infrastructure-as-code tools such as Terraform (for example, terraform plan) and Ansible.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- Palo Alto Networks - Next-Generation Firewall Engineer datasheetBlueprint revised NOVEMBER 2025 · link and content verified 8 September 2026Three domains totalling 100%: PAN-OS Networking Configuration 40%, PAN-OS Device Setting Configuration 40%, Integration and Automation 20% - the domain weights used by CertGrid practice exams exactly. The experience claim is a RECOMMENDATION, and the datasheet is specific about it: "2 to 3 years in an IT security-related field; 2 years with Palo Alto Networks NGFW solutions", plus recommended (not required) NetSec Professional and NetSec Analyst certifications.
- Palo Alto Networks - certification handbooklink and content verified 8 September 2026"For ALL Palo Alto Networks Certification exams, the converted raw passing score is 860 on a scale of 300 to 1000." That single sentence settles the pass mark for all seven guides, and it is why five of them no longer say "a scaled passing score of 700" - 700 is CertGrid's own grading threshold, never Palo Alto's. The handbook also explains why the figure is scaled: cut scores are set per exam form by the Certification Committee, and scaling absorbs the difficulty variation between forms.
The vendor does not publish this. Palo Alto publishes neither an item count nor an exam length on its certification pages, in the datasheets or in the handbook - the handbook sends candidates to Pearson VUE for the appointment time, and notes that the time shown there is the whole appointment, including reading the candidate agreement, rather than answering time. So the 90 minutes on this guide is unverified from Palo Alto's own documents, and the question count is already shown as "Varies" rather than as a Palo Alto figure.