Palo Alto Networks Certified Network Security Professional

NETSG · ● Active · Professional · Palo Alto Networks

Current Status (May 2026): The NETSG (Network Security Professional) certification is the primary breadth-focused professional-level credential in Palo Alto Networks' role-based certification framework, which launched August 1, 2025. This exam replaced legacy legacy generalist certifications and validates hands-on competency across Palo Alto Networks' network security product portfolio, including Strata firewalls, cloud-native deployments, and centralized management platforms. New certification structure is more aligned with modern cloud-native architectures and platform-agnostic security operations roles.

Exam facts

Vendor source — Palo Alto Networks Education & Certification ↗

Exam voucher — PAV-NETSG-CVCH on Palo Alto Store ↗

Pearson VUE testing info — Palo Alto Networks on Pearson VUE ↗

Official course — Network Security Professional Course ↗

About

The Palo Alto Networks Certified Network Security Professional (NETSG) is a modern, role-based professional-level credential that validates hands-on knowledge of Palo Alto Networks' integrated network security solution portfolio. Launched August 1, 2025, as part of a comprehensive certification restructure, NETSG replaced legacy generalist credentials and aligns directly with mid-tier security operations, network administration, and threat prevention roles. The exam covers baseline configuration and deployment across Palo Alto's Strata product family (next-generation firewalls, cloud-native CN-Series, VM-Series virtual firewalls), Strata Cloud Manager (centralized policy and device management), and foundational threat prevention concepts. Unlike the retired PCNSA (associate-level) and PCNSE (specialist-level) legacy certs, NETSG assumes 1–2 years hands-on platform experience and tests breadth across the entire product ecosystem rather than depth in a single vertical. The credential is valid for 2 years and is the primary stepping stone toward specialist certifications (NGFW Engineer, SOC Professional) and architect-level credentials.

Role-based framework context (August 2025 restructure)

Timeline:

• Announced: June 2024 — Palo Alto Networks published comprehensive certification modernization roadmap
• Legacy sunset: March 31, 2025 (PCNSA, PCCET, PCSFE) and July 31, 2025 (PCNSE, PCCSE, PCSAE, PCDRA)
• New framework live: August 1, 2025 — Four-tier role-based ladder across three tracks: Network Security, Cloud Security, Security Operations

New role-based framework structure:

1. Foundational (entry; no experience required) — Network Security Foundational, Cloud Security Foundational, SOC Foundational
2. Professional (mid-tier breadth; 1–2 years experience) — Network Security Professional (NETSG), Cloud Security Professional, SOC Professional
3. Specialist (deep expertise in a domain) — NGFW Engineer, Incident Responder, Threat Intelligence Analyst, Cloud Network Architect
4. Architect (5+ years experience; design + leadership) — Network Security Architect, Cloud Security Architect, Security Operations Architect

NETSG positioning: Mid-tier breadth credential ideal for network security analysts, junior network engineers, firewall administrators transitioning from legacy certs, and hands-on security operations professionals with 1–2 years Palo Alto platforms experience.

Domain context — Network Security / Strata / PAN-OS

Firewall administration, next-generation network security product deployment, and centralized management platform operations. The NETSG targets professionals responsible for installing, deploying, operating, administering, and troubleshooting Palo Alto Networks' Strata firewall family and cloud-native security services.

Read full deep dive — Palo Alto Networks Ecosystem ↗

Exam objectives (role-based framework blueprint)

The NETSG exam is organized into four primary domains with weighted coverage:

1. Installation, Configuration, and Baseline Deployment (30%)

• Firewall hardware and virtual form factors (PA-Series, CN-Series, VM-Series)
• Initial setup, licensing, and management interface access
• Interface configuration, zones, and network addressing
• Basic routing and network connectivity
• Device registration and Strata Cloud Manager onboarding
• Platform fundamentals: stateful inspection, threat prevention concepts

2. Security Objects and Policies (35%)

• Address, service, and URL category object creation and management
• Policy rule design, ordering, and enforcement
• Application-based policy and User-ID integration
• Security profiles (antivirus, anti-spyware, vulnerability protection, file blocking)
• Threat prevention subscription selection and application
• NAT policies and network address translation concepts
• Policy logging and traffic analysis

3. Management and Monitoring (20%)

• Strata Cloud Manager interface and workflows
• Device management, policy deployment, and updates
• Logging, reporting, and alerting fundamentals
• Admin roles, authentication, and access control
• Backup and restore procedures
• Basic troubleshooting workflows and support tools

4. Cloud and Advanced Deployments (15%)

• Cloud-native deployments (Prisma Cloud integration concepts)
• SASE architecture overview
• Multi-site management and policy consistency
• SSL/TLS inspection basics
• Threat prevention in hybrid cloud environments

Source: Palo Alto Networks NetSec-Pro Exam Syllabus ↗ · FlashGenius 2026 Certification Guide ↗

Common skills at Network Security · Professional

Shared content for the Network Security domain at Professional level — not specific to NETSG.

• Firewall policy design and enforcement — Rule ordering, traffic matching, logging configuration, performance optimization
• Threat prevention configuration — Subscription selection, profile tuning, malware detection, vulnerability assessment, file blocking
• Identity and access management — User-ID integration, Active Directory/LDAP binding, zone-based access control, admin RBAC
• Network fundamentals — OSI model, TCP/IP, routing, VPN protocols (IPSec, SSL/TLS), DNS resolution, network segmentation
• Centralized management — Multi-device policy consistency, template management, device group hierarchies, policy inheritance
• Monitoring and observability — Log analysis, traffic forensics, alert triage, dashboards, compliance reporting
• Incident response — Rule hit analysis, capture analysis, traffic reconstruction, containment procedures
• Cloud-native security — API-driven deployments, infrastructure-as-code security, zero-trust architecture concepts

Recommended courses at Network Security · Professional

Course-selection note: Palo Alto Networks' official Network Security Professional course (launched August 2025) is the authoritative source; complete before exam attempt if available. Beacon self-paced labs are excellent for hands-on practice with virtual firewalls. Community Udemy courses typically lag official content by 3–6 months but remain relevant for foundational concepts. DataCipher guides bridge legacy PCNSA/PCNSE knowledge to new role-based framework.

Practice exams

Practice exam advisory: NWExam and ITDojo maintain the most current question banks for the new role-based certs (as of May 2026). Whizlabs has recently updated practice exams; verify they reference PAN-OS 12.x or newer. Beacon free labs are gold-standard for hands-on; invest time in actual firewall configuration rather than memorizing Q&A. Community braindumps should be treated as reference only.

Books

Book advisory: "Mastering Palo Alto Networks" (3rd Edition, 2024) is the contemporary standard, covering PAN-OS 10.x–12.x. "Strata Firewall Essentials" (2023) bridges legacy and new platforms well. Self-published guides on Amazon KDP and O'Reilly Early Release (2025–2026) specifically target the new role-based framework; quality varies. Prioritize hands-on labs over reading; Palo Alto Networks content moves faster than printed materials.

Typical job titles at Network Security · Professional

Firewall Administrator · Network Security Analyst · Junior Network Security Engineer · Security Operations Analyst (SOC) · Network Security Specialist · Cloud Security Operations Analyst · Junior Security Architect

(Job titles drawn from 2025–2026 postings requiring NETSG or equivalent 1–2 years hands-on Palo Alto Networks experience. Roles emphasize centralized management, cloud-native deployments, and SOC integration over single-box firewall administration.)

Salary

Salary note: NETSG holders with 1–2 years hands-on experience typically command mid-tier security salaries. USD figures reflect US Glassdoor/PayScale 2025 data. ZAR salaries (R660k–R900k annual) position candidates in South Africa for mid-to-senior network security analyst roles in enterprise IT/finance/telecoms sectors. NETSG is a stepping stone toward NGFW Engineer (specialist) or Architect roles commanding 20–40% salary premiums. Certification without hands-on lab time yields smaller salary uplift; combine study with practical firewall deployments.

Skills validated

Concrete technologies and platforms tested on the NETSG exam (PAN-OS 12.x / Strata 2026):

• Palo Alto Networks Strata NGFW — PA-Series (hardware), CN-Series (container-native), VM-Series (virtual) platforms
• PAN-OS fundamentals — Version 10.x through 12.x, web UI, CLI administration
• Strata Cloud Manager (SCM) — Centralized policy management, device enrollment, deployment workflows
• Threat Prevention Services — Antivirus, anti-spyware, vulnerability protection, file blocking, DNS security, URL filtering
• Security Policy Framework — Object creation (addresses, services, URL categories), policy rule design, application-based control
• User-ID and Authentication — Active Directory/LDAP integration, user mapping, zone-based access control
• Network Address Translation (NAT) — Source, destination, dynamic IP, policy-based, port translation
• Virtual Private Networks (VPN) — GlobalProtect SSL/TLS VPN, IPSec concepts, remote access
• Logging and Reporting — Syslog forwarding, log queries, compliance reporting, dashboards
• Multi-site Management — Device hierarchies, policy inheritance, centralized logging, firmware management
• High Availability (HA) — Active-active and active-passive failover concepts, session synchronization
• Cloud and SASE integration — Prisma Cloud console access, security service edge (SSE) fundamentals, hybrid cloud concepts
• Troubleshooting — Log analysis, traffic capture interpretation, rule debugging, common remediation workflows

Related certifications

• Prerequisite for (NETSG → specialist/architect): Palo Alto NGFW Engineer ↗ [Specialist depth in NGFW; 90 min, $250 USD] · Palo Alto Cloud Security Professional ↗ [Specialist in cloud/Prisma; 90 min, $250 USD]
• Entry point before NETSG: Palo Alto Networks Security Foundational ↗ [If 0–6 months Palo Alto experience; 90 min, $150 USD]
• Parallel professional-tier cert: Palo Alto SOC Professional ↗ [Security operations focus; 90 min, $200 USD]
• Legacy equivalent (retired): Palo Alto PCNSA ↗ [Retired March 31, 2025; holders should transition to NETSG]
• Vendor overview: Palo Alto Networks Ecosystem ↗

Transition guidance (May 2026)

If you're studying for NETSG (new certification track):

1. NETSG assumes 1–2 years hands-on Palo Alto Networks experience (firewall deployment, policy management, cloud platform familiarity).
2. If you're a complete newcomer, consider Network Security Foundational (no experience required; 90 min, $150 USD) first.
3. Primary study resources: Palo Alto Networks' official course (EDU-115 or equivalent), Beacon free labs, and hands-on firewall configuration (Palo Alto's free VM-Series eval license).
4. Exam emphasizes modern platform features: Strata Cloud Manager, cloud-native deployments, API integration, and PAN-OS 12.x concepts.

If you're transitioning from legacy PCNSA/PCNSE:

1. Your PCNSA/PCNSE hands-on knowledge is directly applicable; NETSG tests breadth across modern Strata portfolio.
2. Focus new study on: Strata Cloud Manager (centralized management paradigm shift from Panorama), cloud deployments (Prisma integration), and modern threat prevention.
3. Expect questions on containerized CN-Series and VM-Series virtual firewalls alongside traditional PA-Series hardware.
4. Beacon learning portal bridges legacy and new curriculum; many concepts transfer, but tool UIs have changed.

Sources

• Palo Alto Networks Education & Certification Portal
• Palo Alto Networks Network Security Professional Course
• Palo Alto Store NETSG Voucher (PAV-NETSG-CVCH)
• Pearson VUE Palo Alto Networks Testing Centers
• FlashGenius — 2026 Palo Alto Networks Certifications Guide
• DataCipher — Network Security Professional Certification Guide 2025
• NWExam — Palo Alto NetSec-Pro Exam Syllabus
• PassItExams — Palo Alto Networks Certifications Cost Guide
• PassItExams — Palo Alto Certifications Career Path
• Mastering Palo Alto Networks (3rd Edition, 2024)
• Palo Alto Networks Strata Firewall Essentials (2023)
• Glassdoor — Palo Alto Networks Salaries
• PayScale — Network Security Engineer Salary (USA)
• PayScale — Network Security Engineer Salary (South Africa)
• Robert Half 2026 IT Salary Guide
• IT Jobs Watch — UK Salary Data
• Hays 2026 Salary Guide
• SEEK — Australia Job Salaries
• Pnet South Africa — Job Salaries

Last verified: 2026-05-01
Certification launch: August 1, 2025
Parent ecosystem: Palo Alto Networks Ecosystem
Parent domain: Security Domain

Exam environment & delivery (May 2026)

As of August 1, 2025, all Palo Alto Networks certification exams, including NETSG, are delivered exclusively at in-person Pearson VUE test centers. Remote proctoring (OnVUE) is no longer offered. Candidates must schedule an exam appointment at a Pearson VUE center near them using their legal name and government-issued ID. Photo identification and center-administered photograph verification are mandatory. Exam scheduling may be done in advance or same-day, subject to test center availability. Vouchers expire 12 months after purchase; ensure exam is scheduled and completed within that window.

Key takeaways

The NETSG (Network Security Professional) is Palo Alto Networks' modern, breadth-focused professional-level credential for network security analysts, junior network engineers, and hands-on security operations professionals with 1–2 years Palo Alto platform experience. Launched August 1, 2025, as part of a comprehensive role-based restructure, NETSG replaced legacy generalist certs and directly targets roles managing firewall deployment, threat prevention configuration, and centralized policy through Strata Cloud Manager. The 90-minute exam (60–75 questions, $200 USD) tests hands-on knowledge across the entire Strata product portfolio (PA-Series, CN-Series, VM-Series firewalls) and modern threat prevention services. Valid for 2 years, NETSG serves as the stepping stone toward specialist certifications (NGFW Engineer, SOC Professional) and architect-level credentials. Unlike legacy one-box firewall certifications, NETSG emphasizes cloud-native deployments, API-driven management, and multi-site consistency—reflecting modern enterprise security architecture. Combine exam prep with hands-on lab work on Beacon and Palo Alto's free evaluation licenses; theory alone yields poor results on scenario-based questions.

Certification deeply verified via Palo Alto Networks official portals, Pearson VUE testing information, current salary surveys (USD/ZAR), and community prep resources as of May 1, 2026. NETSG is the primary professional-tier credential in the active (post-August 2025) Palo Alto Networks certification framework.