The NetSec-Pro exam blueprint has six domains, and the largest one, Platform Solutions, Services, and Tools, carries 30% of the score on its own. The other five sit between 10% and 17%, and you need a scaled score of 860 on a 300 to 1000 scale to pass.
That shape tells you how to study. Palo Alto Networks Certified Network Security Professional (NetSec-Pro) is not a firewall exam with a few cloud questions added. It covers the whole network security portfolio: hardware and software firewalls, Prisma Access, Prisma SD-WAN, the Cloud-Delivered Security Services, Strata Cloud Manager and Panorama, plus three newer topics on trust, quantum risk and AI risk. This entry walks through the June 2026 blueprint domain by domain, turns it into a six-week plan, and lists the mistakes that cost people the most points. Every exam fact here was checked on Palo Alto Networks' own pages and documents on 31 October 2026.
What is the NetSec-Pro exam?
NetSec-Pro is the Professional level of the Network Security track in Palo Alto Networks' role-based certification program. Above it sit the Specialist exams (Network Security Analyst, Next-Generation Firewall Engineer, SD-WAN Engineer and Security Service Edge Engineer) and, at the top, Network Security Architect.
The official NetSec-Pro certification page describes the target candidate as a networking or security professional who installs, deploys, operates or administers the Palo Alto Networks network security portfolio. The datasheet adds that it checks "entry level" configuration and maintenance skills, and basic installation and deployment.
The key facts, from Palo Alto Networks' datasheet, certification FAQ and certification handbook:
- Fee: US$200, the price of every Professional-level exam. Taxes and local fees can be added depending on the country.
- Passing score: 860 on a scaled range of 300 to 1000. The handbook says this applies to all Palo Alto Networks certification exams.
- Language: English worldwide. Candidates testing in non-English-speaking countries, Japan included, get a 30-minute time extension by default.
- Delivery: booked through Pearson VUE.
- Validity: two years. You recertify by taking the exam again.
- Questions and time: the datasheet and the FAQ do not state a question count or a time limit. Your appointment length shows when you book.
- Unscored items: the exam can include pretest questions that look like the others but do not count toward your score.
What does the NetSec-Pro exam blueprint cover?
The Network Security Professional datasheet (June 2026) lists six domains and 22 numbered tasks. The weights are the share of the exam score that each domain carries.
- Network Security Fundamentals, 17%. Four tasks.
- NGFW and SASE Solution Functionality, 13%. Four tasks.
- Platform Solutions, Services, and Tools, 30%. Six tasks, one of them with six sub-topics.
- NGFW and SASE Solution Maintenance and Configuration, 10%. Two tasks.
- Infrastructure Management and CDSS, 17%. Four tasks.
- Connectivity and Security, 13%. Two tasks.
One detail matters more than the list. Almost every task starts with "Explain", and the rest start with "Identify and describe". There is no "configure" verb in the sense of typing commands. The exam asks whether you understand what each product does, where it fits and why you would pick it. Lab time still helps, because it is the fastest way to understand a feature, but you are not being tested on menu paths.
What is in Domain 1, Network Security Fundamentals (17%)?
This domain is the base layer for everything else. It has four tasks:
- Application Layer inspection on Strata and SASE products.
- Slow path and fast path in packet inspection: what happens to the first packet of a session and what happens after the session is set up.
- Decryption: SSL Forward Proxy, SSL Inbound Inspection, SSH Proxy, and when to choose no decryption at all.
- Network hardening methods: Content-ID, Zero Trust, User-ID, Device-ID and zones.
If you come from a different firewall vendor, spend your time on the packet flow and on App-ID thinking. Policies here are written around applications and users, not only ports and addresses, and many questions in later domains assume you already think that way.
What do Domains 2 and 4 ask about NGFW and SASE products (13% + 10%)?
These two domains belong together. Domain 2 asks what each product does; Domain 4 asks how you keep it configured and up to date.
Domain 2 names four product families:
- Firewalls: Cloud NGFW, PA-Series, CN-Series and VM-Series, with perimeter and core security, zone segmentation, high availability, Security and NAT policy, and monitoring and logging.
- Prisma SD-WAN: WAN optimization, path and NAT policies, zone-based firewalls, monitoring and logging.
- Prisma Access: remote user and remote network configuration, public and private application access, Security and NAT policy.
- Management: Panorama and Strata Cloud Manager (SCM) for managing Strata and SASE solutions.
Domain 4 then covers Security policies, profiles, updates and upgrades on the four firewall form factors and on Prisma Access. A useful way to study is a simple table: for each form factor, where it runs (appliance, hypervisor, Kubernetes, public cloud marketplace), how it is managed, and how it gets content and software updates.
Why is Domain 3, Platform Solutions, Services, and Tools, worth 30%?
Because it is the widest. It has six tasks:
- Security efficacy of NGFW and Prisma SASE products: Security and NAT policy, User-ID, App-ID, decryption, monitoring and logging.
- The Cloud-Delivered Security Services (CDSS): IoT Security, Enterprise DLP, SaaS Security, PAN-OS SD-WAN, Premium GlobalProtect, and the Advanced WildFire, Advanced Threat Prevention, Advanced URL Filtering and Advanced DNS services.
- AIOps and how it lines up with Palo Alto Networks best practices: dashboards, the Best Practice Assessment (BPA) and administration.
- Next-Generation Trust Security (NGTS): identity governance, trust relationships and adaptive security decisions.
- Quantum security risks, such as "harvest now, decrypt later" attacks, and platform answers such as post-quantum readiness and hybrid cryptography.
- AI-related risks: AI use, sensitive data exposure, AI application access and AI-enabled threats, and how the platform can discover, monitor, control and secure them.
The last three tasks are the newest part of the blueprint and the easiest to skip by accident, because older study guides do not have them. For each one, be able to say in two sentences what the risk is and which part of the platform addresses it.
For the CDSS list, a one-line definition per service is the right depth. You should be able to tell Advanced WildFire (unknown files and malware analysis) apart from Advanced Threat Prevention (exploits and command-and-control in traffic), and Advanced URL Filtering from Advanced DNS Security.
What does Domain 5, Infrastructure Management and CDSS (17%), add?
Domain 5 moves from "what does the service do" to "how is it run". Its four tasks are:
- Security policies, profiles and updates for the CDSS.
- IoT security in practice: Security policies, Device-ID, monitoring and logging.
- Enterprise DLP and SaaS Security: data encryption, access control, monitoring and logging.
- SCM and Panorama: supported products, adding a new device, reporting and configuration management.
Expect questions that compare SCM and Panorama. Know which one is cloud-delivered, which products each one can manage, and what "adding a new device" involves in each.
What does Domain 6, Connectivity and Security (13%), test?
Domain 6 is about keeping traffic both connected and protected. One task covers on-premises, cloud and hybrid networks (segmentation, policies, monitoring and logging, certificates). The other covers remote users: remote access options, segmentation, Security policy tuning, logging and certificates.
Certificates appear in both tasks, so do not leave them for the end. Know where a certificate is needed for decryption, for remote access and for device trust.
A worked scenario from Domain 1
Here is a scenario in my own words, of the kind the blueprint points to. It is not a recalled exam item.
A company runs a public web application on its own server behind a Palo Alto Networks firewall. The security team wants to see threats hidden inside the encrypted traffic coming in to that server. Which decryption type fits?
The answer is SSL Inbound Inspection. The company owns the server, so it can load the server's certificate and private key on the firewall, and the firewall can decrypt traffic heading to that server. SSL Forward Proxy is the opposite case: it is for internal users going out to websites the company does not own, where the firewall acts as a proxy and signs certificates on the fly. SSH Proxy covers SSH sessions, and "no decrypt" is the policy choice for traffic you decide not to inspect, for example for privacy or legal reasons.
Most decryption questions come down to one thing: who owns the destination, and in which direction does the session go?
How should you plan six weeks for NetSec-Pro?
Six weeks at around six to eight hours a week works for someone who already knows networking basics. Give the time in proportion to the weights:
- Week 1, Domain 1 (17%). Packet flow, App-ID, User-ID, Device-ID, zones and the four decryption choices.
- Week 2, Domains 2 and 4 (23% together). The four firewall form factors, Prisma Access, Prisma SD-WAN, and how each one is updated and upgraded.
- Week 3, Domain 3 part one (30% for the whole domain). Security efficacy and the CDSS services, one definition each.
- Week 4, Domain 3 part two. AIOps and BPA, then NGTS, quantum risk and AI risk.
- Week 5, Domain 5 (17%). CDSS operations, IoT Security, Enterprise DLP, SaaS Security, and SCM compared with Panorama.
- Week 6, Domain 6 (13%) and review. Connectivity, remote users and certificates, then go back through all 22 tasks and mark any you cannot explain out loud.
The official route is the digital learning path linked from the certification page. Palo Alto Networks' datasheet also suggests researching the keywords in each blueprint task in its documentation, which is a good way to handle the newer topics.
The same idea, time in proportion to what the blueprint asks, is how I built a lab map of the JN0-364 JNCIS-SP exam objectives for Juniper's service provider exam.
The NWExam channel has a short video on the exam format, topics and a study plan:
What mistakes cost NetSec-Pro candidates the most?
- Treating it as a firewall exam. NGFW topics are spread across several domains, but Prisma Access, SD-WAN, CDSS, SCM and the newer trust, quantum and AI topics fill a large part of the score.
- Skipping tasks 3.4 to 3.6. NGTS, quantum risk and AI risk are short lines in the blueprint, but they sit inside the 30% domain.
- Memorizing menu paths. The verbs are "Explain" and "Identify and describe". Spend the time on why a feature exists and when you would pick it.
- Mixing up SCM and Panorama. Both manage Strata and SASE solutions, and Domains 2 and 5 both ask about them.
- Using leaked question sets. The handbook says a candidate found using unauthorized training material is banned from Palo Alto Networks exams for at least 12 months and loses related certifications.
What happens if you fail, and how long is the certification valid?
The Palo Alto Networks certification program FAQ sets the retake waits: 15 days after a first failed attempt, 30 days after a second, and 90 days after a third and any later attempt. Your score report breaks your result down by domain, so you know where to put the extra time.
Once you pass, the certification is valid for two years, and you cannot sit the same exam again for 18 months (545 days). To stay active, you recertify by taking the exam again before it expires.
How do you book the exam?
You book through Pearson VUE's Palo Alto Networks page, which also links the voucher store and its online testing information.
Read the cancellation rule before you pick a date: you must cancel or reschedule at least 48 hours before the appointment, or the fee is lost.
For a one-page summary of the exam and its syllabus, see the NetSec-Pro certification overview on NWExam.
Frequently asked questions
1. What is the passing score for the NetSec-Pro exam?
You need a scaled score of 860 on a range of 300 to 1000. Palo Alto Networks uses the same 860 pass mark for all of its certification exams.
2. How much does the NetSec-Pro exam cost?
The fee is US$200, the same as every Professional-level Palo Alto Networks exam. Taxes and fees can be added depending on the country.
3. Which domain has the biggest weight in the NetSec-Pro blueprint?
Platform Solutions, Services, and Tools is the biggest domain at 30%. It covers the Cloud-Delivered Security Services, AIOps, NGTS, quantum risk and AI risk.
4. How long is the NetSec-Pro certification valid?
It is valid for two years from the day you pass. You recertify by taking the exam again before it expires.
5. Is the NetSec-Pro exam offered in Japanese?
No. Palo Alto Networks delivers its exams in English worldwide, and candidates in non-English-speaking countries, including Japan, get 30 extra minutes by default.