NGFW Engineer study guide · 2026

The 3 NGFW Engineer domains, explained

3 domains and 18 official objectives. PAN-OS Networking Configuration carries the most weight at 40%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 1 See all domains
Questions
Not published (multiple choice, matching and ordering items; includes unscored pretest items)
Time
Not published by Palo Alto Networks (training partners list 90 minutes; +30 minutes by default in non-English-speaking countries)
Passing score
860 on a scaled score of 300 to 1000
Outline
NGFW Engineer exam datasheet, November 2025 (current as of October 2026)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 40%
  2. 2 40%
  3. 3 20%
  1. 1 PAN-OS Networking Configuration
  2. 2 PAN-OS Device Setting Configuration
  3. 3 Integration and Automation

All 3 domains

18 official objectives 62–76 hrs suggested study

  1. Domain 01 40%

    PAN-OS Networking Configuration

    One of the two largest domains at 40% of the score. It tests how you build the PAN-OS data plane: interface types, zones, high availability pairs, static and dynamic routing, GlobalProtect remote access, and IPSec, quantum-resistant and GRE tunnels.

    Inside this domain

    • Configure interface
    • Configure zones
    • Configure high availability (HA)
    • Configure routing
    • and 2 more objectives

    Watch for Tap for blocking

    Objectives
    6
    Questions est.
    ~24
    Study time est.
    25–30 hrs
  2. Domain 02 40%

    PAN-OS Device Setting Configuration

    Worth 40% of the score, this domain covers how the firewall itself is set up: administrator authentication, virtual systems, logging destinations, software upgrades, certificates for decryption and services, User-ID with the Cloud Identity Engine, and the PAN-OS web proxy.

    Inside this domain

    • Implement authentication roles, profiles, and sequences
    • Configure virtual systems (VSYS)
    • Configure logging
    • Implement PAN-OS software updates
    • and 3 more objectives

    Watch for Self-signed forward trust

    Objectives
    7
    Questions est.
    ~24
    Study time est.
    25–30 hrs
  3. Domain 03 20%

    Integration and Automation

    The smallest domain at 20% of the score. It covers installing each NGFW form factor, automating with APIs and tools such as Terraform and Ansible, managing firewalls centrally with Panorama, and building ACC dashboards and custom reports.

    Inside this domain

    • Install the selected deployment option
    • Use APIs to automate deployment
    • Manage third-party services to deploy NGFWs (e.g., Kubernetes, hypervisors, CSPs, Terraform, Ansible)
    • Use on-premises centralized management
    • and 1 more objectives

    Watch for Policy in a template

    Objectives
    5
    Questions est.
    ~12
    Study time est.
    12–16 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 62–76 hrs of study.

  1. 1 PAN-OS Networking Configuration 40% · 25–30 hrs
  2. 2 PAN-OS Device Setting Configuration 40% · 25–30 hrs
  3. 3 Integration and Automation 20% · 12–16 hrs

Try one

Practice questionDomain 1: PAN-OS Networking Configuration

An active/passive firewall pair connects to the internet through a switch and an upstream ISP router. When the ISP router failed, the firewall links stayed up and no failover occurred. Which configuration change would trigger failover in this situation?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Tap for blocking

    Clue The requirement says prevent or block.

  • Domain 2

    Self-signed forward trust

    Clue Users report certificate warnings on every HTTPS site.

  • Domain 3

    Policy in a template

    Clue The requirement is a rule shared by many firewalls.

Other Cybersecurity certifications

Study guides for exams that overlap with NGFW Engineer.

Practise what you read

NGFW Engineer domains: common questions

How many domains are in the NGFW Engineer exam?

NGFW Engineer has 3 domains with 18 official objectives between them: PAN-OS Networking Configuration, PAN-OS Device Setting Configuration and Integration and Automation.

Which NGFW Engineer domain carries the most weight?

PAN-OS Networking Configuration is the heaviest at 40%, followed by PAN-OS Device Setting Configuration (40%). The lightest is Integration and Automation (20%). Weights come from Palo Alto Networks's official outline.

What is the NGFW Engineer exam format?

Questions: Not published (multiple choice, matching and ordering items; includes unscored pretest items). Time allowed: Not published by Palo Alto Networks (training partners list 90 minutes; +30 minutes by default in non-English-speaking countries). Passing score: 860 on a scaled score of 300 to 1000.

How long should I study for NGFW Engineer?

Our planning estimate is 62–76 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with PAN-OS Networking Configuration, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows NGFW Engineer exam datasheet, November 2025 (current as of October 2026), published by Palo Alto Networks. It was last reviewed in October 2026.

Domain names, weights and objectives come from Palo Alto Networks's official outline (NGFW Engineer exam datasheet, November 2025 (current as of October 2026)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.