If you’re building a career in cybersecurity and working with Palo Alto Networks technology, understanding the certification roadmap is essential. The program was completely redesigned with a role-based framework — replacing old product-specific credentials with certifications that reflect actual job functions.
This guide walks you through every level, every track, current exam fees sourced from the official Pearson VUE store, salary data, and a clear path from beginner to architect.
What Is the Palo Alto Networks Certifications Roadmap?
Direct Answer: The Palo Alto Networks certifications roadmap is a role-based framework organized across four levels — Foundational, Professional, Specialist, and Architect — and three security tracks: Network Security, Security Operations, and Cloud Security. Each certification is designed to validate skills that map directly to real job responsibilities.
The restructuring moved away from product-centric exams like PCNSE and PCNSA toward credentials that answer a different question: not “which Palo Alto product do you use?” but “what is your actual job role?” That shift makes the new certifications more meaningful to employers and more relevant to career progression.
The Four Certification Levels Explained
Level 1: Foundational
The Foundational level is the entry point. According to the official Palo Alto Networks certification portal, two credentials exist at this level:
- Cybersecurity Apprentice — validates foundational knowledge of networking and cybersecurity concepts; designed for those transitioning into a cybersecurity career or non-technical IT professionals who want a documented baseline
- Cybersecurity Practitioner — validates cybersecurity knowledge and basic application skills across the Palo Alto Networks portfolio; suited for those continuing their path in the program
Both exams are priced at $150 USD each, per the official Palo Alto Networks Pearson VUE voucher store.
Level 2: Professional
The Professional level validates knowledge and skills required to perform operations and management tasks across an entire platform. Three certifications currently exist:
- Network Security Professional — validates knowledge of all products in the Palo Alto Networks network security solution, including entry-level maintenance, configuration, installation, and deployment; targets professionals working with NGFWs and SASE technologies
- Security Operations Professional — validates knowledge and job-ready skills for basic application of the Cortex portfolio in a Security Operations Center (SOC)
- Cloud Security Professional — validates skills for cloud-native security across the Palo Alto Networks cloud security portfolio
Professional-level exam vouchers are $200 USD each.
Level 3: Specialist
The Specialist level validates the knowledge and skills required to deploy, operate, and manage a specific product. This is where professionals demonstrate deep, hands-on expertise. The full current Specialist catalog, sourced directly from the official certification portal, includes:
Network Security Track:
- Network Security Analyst — object configuration, policy creation, and centralized management using Strata Cloud Manager (SCM)
- Next-Generation Firewall (NGFW) Engineer — deployment, networking, device settings, integration, automation, and centralized management via Panorama
- SD-WAN Engineer — planning, deploying, configuring, operating, monitoring, and troubleshooting SD-WAN environments
- Security Service Edge (SSE) Engineer — deploying, configuring, managing, and troubleshooting SSE/SASE environments
Security Operations Track:
- XSIAM Analyst — using Cortex XSIAM for automation, threat detection, and threat response
- XDR Analyst — architecture, components, and operation of Cortex XDR in a SOC
- XSIAM Engineer — deploying, configuring, managing, and creating playbooks in Cortex XSIAM
- XDR Engineer — deploying, configuring, managing, and creating playbooks in Cortex XDR
- XSOAR Engineer — deploying, configuring, managing, integrating, and troubleshooting Cortex XSOAR
Specialist exam vouchers are $250 USD each.
Level 4: Architect
The Architect level is the highest credential in the program. Per the official portal, the Network Security Architect certification validates the skills required to understand technical and business requirements, architect secure, highly available, and scalable systems using the Palo Alto Networks network security portfolio, and oversee complex security blueprints using industry frameworks. It is targeted at senior professionals architecting for Zero Trust across enterprise environments.
The Three Career Tracks
The entire certification program runs across three platform-based tracks. Choosing the right track is more important than choosing a level — your track should reflect the type of security work you do every day.
Track 1: Network Security
Covers the core Palo Alto Networks firewall and access product suite — PAN-OS, Panorama, Strata Cloud Manager, Prisma Access, and Prisma SD-WAN. This track spans all four levels and is the most complete track currently available.
Progression: Cybersecurity Apprentice / Practitioner → Network Security Professional → Network Security Analyst / NGFW Engineer / SSE Engineer / SD-WAN Engineer → Network Security Architect
Right for: network engineers, firewall administrators, SASE engineers, and security architects.
Track 2: Security Operations
Covers Cortex XDR, XSOAR, and XSIAM — Palo Alto Networks’ detection, response, and AI-driven SOC platform suite.
Progression: Cybersecurity Practitioner → Security Operations Professional → XSIAM Analyst / XDR Analyst / XSIAM Engineer / XDR Engineer / XSOAR Engineer
Right for: SOC analysts, threat hunters, incident responders, and detection engineers.
Track 3: Cloud Security
Covers cloud-native security across the Palo Alto Networks portfolio, validated by the Cloud Security Professional at the Professional level. Specialist and Architect credentials for this track are expected to expand.
Right for: cloud security engineers, DevSecOps professionals, and those securing multi-cloud or hybrid environments.
Exam Details: Format, Cost, and Registration
| Level | Certifications | Exam Fee |
|---|---|---|
| Foundational | Cybersecurity Apprentice, Cybersecurity Practitioner | $150 USD |
| Professional | Network Security Professional, Security Operations Professional, Cloud Security Professional | $200 USD |
| Specialist | NGFW Engineer, NSA, SSE Engineer, SD-WAN Engineer, XDR Analyst, XDR Engineer, XSIAM Analyst, XSIAM Engineer, XSOAR Engineer | $250 USD |
| Architect | Network Security Architect | Contact vendor |
All pricing is sourced from the official Palo Alto Networks Pearson VUE voucher store.
Exam format: Computer-based assessments delivered at Pearson VUE test centers. Per the Pearson VUE Palo Alto Networks exam page, exams include multiple choice, matching, and ordering question types.
Testing mode: All exams are delivered in person only at Pearson VUE test centers. Online proctoring is not available.
Validity: All certifications are valid for 2 years. Earning a higher-level certification in the same track automatically renews lower-level credentials in that track for an additional 2 years — so progressing through the roadmap keeps your full portfolio current.
Prerequisites: No formal prerequisites exist across the program. Each certification’s official page on paloaltonetworks.com lists recommended experience and suggested training, but none are mandatory requirements.
To register, visit the Pearson VUE Palo Alto Networks scheduling portal, create a vendor-specific account, and book your test center appointment.
What Happened to PCNSE, PCNSA, and PCCET?
This is one of the most common questions from professionals who earned credentials under the old program.
- PCNSA (Network Security Administrator) — retired August 31, 2024
- PCNSE (Network Security Engineer) — retired July 31, 2025
- PCCET (Cybersecurity Entry-level Technician) — retirement scheduled April 30, 2026
If you hold an active credential from any of these retired exams, it remains valid until your individual expiration date. You do not lose the credential retroactively. When it’s time to recertify, you transition into the current role-based framework.
The closest current equivalents:
| Retired Cert | Closest New Equivalent |
|---|---|
| PCNSA | Network Security Professional (Professional level) |
| PCNSE | NGFW Engineer (Specialist level) |
| PCCET | Cybersecurity Apprentice or Cybersecurity Practitioner (Foundational level) |
How to Choose the Right Certification
- New to Palo Alto Networks entirely?
Begin with Cybersecurity Apprentice or Cybersecurity Practitioner to establish your baseline, then move to the Professional level in the track matching your target role.
- Already working with Palo Alto firewalls daily?
Go directly to Network Security Professional for broad validation, then add NGFW Engineer or Network Security Analyst at the Specialist level to demonstrate depth.
- Working in a SOC environment?
Security Operations Professional gives you platform-wide breadth across Cortex. XSIAM Analyst or XDR Analyst Specialist credentials align directly with detection and investigation workflows.
- Senior engineer targeting design leadership?
Stack Specialist credentials in your primary track, then pursue the Architect credential. The Network Security Architect is live now; additional Architect credentials are expected to follow.
Jobs and Salaries for Palo Alto Networks Certified Professionals
Roles requiring Palo Alto Networks expertise command competitive compensation. Here is salary data sourced from Glassdoor and the US Bureau of Labor Statistics:
| Role | Avg. Annual Salary (US) | Source |
|---|---|---|
| Network Security Engineer | ~$120K–$170K | Glassdoor, 2026 |
| Security Operations / SOC Engineer | ~$110K–$165K | Glassdoor, 2026 |
| Cloud Security Engineer | ~$130K–$185K | Glassdoor, 2026 |
| Security Architect | ~$150K–$200K+ | Glassdoor, 2026 |
| Information Security Analyst (national median) | $124,910/year | BLS.gov, 2024 |
According to the US Bureau of Labor Statistics, employment of information security analysts is projected to grow 33% over the next decade — far faster than the average for all occupations. That demand directly benefits professionals holding vendor-specific certifications in high-deployment platforms like Palo Alto Networks.
Job titles actively hiring Palo Alto Networks-certified professionals include Firewall Engineer, SASE Engineer, SOC Analyst, XDR/XSIAM Engineer, Network Security Architect, and Cybersecurity Consultant.
How to Prepare: Study Resources and Tips
Official Resources (Only)
The primary learning platform is learn.paloaltonetworks.com — Palo Alto Networks’ official digital learning hub offering guided learning paths, e-learning modules, and role-specific training aligned directly to each certification’s blueprint.
Additional official resources for every candidate:
- Certification Candidate Handbook — available on each certification’s page at paloaltonetworks.com; covers exam domains, weightings, policies, and logistics
- Official Exam Datasheets — downloadable PDF blueprints that list every tested domain and its weighting; the single most important study planning tool
- Palo Alto Networks TechDocs (docs.paloaltonetworks.com) — the authoritative source for platform configuration, product behavior, and architecture guidance
- LIVEcommunity (live.paloaltonetworks.com) — official community forums with exam discussions, study group posts, and program announcements directly from Palo Alto Networks
- Cyberpedia and Resource Center — visual guides, quick-reference articles, and domain-specific video content hosted on the official Palo Alto Networks site
Practice Testing and Exam Prep
Hands-on lab work is essential, particularly at the Specialist level. Combining official learning paths with structured practice testing before booking your Pearson VUE appointment is the most effective preparation approach. PassITExams provides practice tests and study materials for IT certifications, including resources that complement your official Palo Alto Networks preparation.
Recommended Study Timelines
- Foundational exams: 2–4 weeks using official free modules and the exam datasheet
- Professional exams: 4–8 weeks combining official learning paths with hands-on product practice
- Specialist exams: 8–12 weeks minimum; assumes active daily product experience plus structured study
Common Mistakes to Avoid
- Studying outdated material: PCNSE and PCNSA content is no longer current. Verify the publication date of any guide before using it — a lot of older prep material still circulates online and covers retired exam objectives.
- Ignoring the official exam datasheet: Every certification has a published blueprint listing domains and their percentage weighting. Some domains represent 18–19% of the total exam score. Skipping this document is the single biggest preparation mistake.
- Underestimating hands-on requirements: The Specialist-level exams are built around real-world tasks — configuring policies, managing HA, working with Strata Cloud Manager, building XSIAM playbooks. Theoretical study alone won’t be enough.
- Jumping tracks without a plan: Earning Professional and Specialist credentials across different tracks without a clear direction doesn’t communicate a coherent skill set to employers. Pick one primary track, develop depth, then expand.
- Missing the reschedule window: Exam appointments must be changed at least 48 hours in advance through the Pearson VUE portal to avoid forfeiting your voucher fee.
Frequently Asked Questions
Are Palo Alto Networks exams available online?
No. All exams are delivered in person at Pearson VUE test centers only.
What types of questions appear on the exams?
Per the official Pearson VUE page, exams include multiple choice, matching, and ordering question types.
How long are certifications valid?
All Palo Alto Networks certifications are valid for 2 years. Earning a higher-level certification in the same track extends active lower-level credentials by an additional 2 years.
What replaced the PCNSE?
The NGFW Engineer Specialist certification is the closest role-based equivalent. The Network Security Professional replaces the broader administrative scope previously covered by PCNSA.
Is PCCET still available?
The PCCET is scheduled for retirement on April 30, 2026. New candidates should pursue the Cybersecurity Apprentice or Cybersecurity Practitioner Foundational credentials instead.
How much do the exams cost?
Foundational: $150 USD | Professional: $200 USD | Specialist: $250 USD — per the official Pearson VUE voucher store. Vouchers are valid for 12 months from purchase.
Are there prerequisites for any certification?
No hard prerequisites exist. However, each certification page on paloaltonetworks.com lists recommended experience and training to prepare effectively.
Can I earn certifications across multiple tracks?
Yes. Certifications are stackable across all three tracks — Network Security, Security Operations, and Cloud Security — with no restrictions.
Where do I register for exams?
Through the official Pearson VUE Palo Alto Networks portal. Create a vendor-specific Pearson VUE account for Palo Alto Networks.
Which certification should I start with if I’m completely new?
The Cybersecurity Practitioner is the recommended starting point. It provides a documented baseline across the Palo Alto Networks portfolio and serves as the natural entry point into any of the three tracks.
Conclusion
The Palo Alto Networks certifications roadmap is now one of the most clearly structured vendor certification programs in cybersecurity. The role-based framework — Foundational, Professional, Specialist, and Architect across Network Security, Security Operations, and Cloud Security — makes it straightforward to match credentials to your actual job function and career goals.
Whether you’re starting fresh, transitioning from legacy credentials like PCNSE or PCNSA, or building toward an Architect designation, the path is well-defined. Use official resources from learn.paloaltonetworks.com, study from the official exam datasheets, and build hands-on experience in the platform before sitting your exam.For structured practice testing alongside your official preparation, PassITExams offers exam prep materials across major IT certifications to help reinforce your readiness.
