Revision Guide · Certified Next-Generation Firewall (NGFW) Engineer

Palo Alto Networks NGFW — Complete Revision

Every core capability of the Palo Alto Networks Next-Generation Firewall, explained as why it exists, how it works, and its pros / cons — built to cover the full "Certified Next-Generation Firewall (NGFW) Engineer" curriculum (PAN-OS, Identity, Software Firewall/CN-Series/VM-Series, and Reading Traffic Logs courses), not just a general documentation summary. Course-mapped sections carry a course badge naming the lesson they correspond to. Sourced from the locally scraped PAN-OS 11.1 / NGFW admin documentation plus the official Certified NGFW Engineer learning-path course export.

🎯 Master Cheat Sheet & Mental Models Hub 📖 Glossary 📝 Practice Exam
Topic icon — quick visual ID for the module
Learning objectives — what you should walk away knowing
Pros / Cons
Exam trap — a real, specific mistake to avoid
CH Master Cheat Sheet fact / Blueprint requirement
CLI Command verification syntax
Module quiz — scored, at the end of each page
Domain 1 (40%) 2 sections

Foundations

Starts with: What Makes It a "Next-Generation" Firewall • Single-Pass Architecture
Domain 1 (40%) 3 sections

Traffic Classification

Starts with: App-ID • User-ID • Content-ID
Domain 2 (40%) 3 sections

Encrypted Traffic

Starts with: SSL/TLS & SSH Decryption • Forward Trust vs Untrust CA • CLI
Domain 1 (40%) 3 sections

Policy & Segmentation

Starts with: Security Policy & Zone-Based Architecture • NAT • Zone Protect
Domain 1 & 2 8 sections

Firewall Fundamentals & Admin

Starts with: Admin Roles • 6 Interface Types • Web Proxy • Logical Routers
Domain 1 (40%) 4 sections

Threat & Content Services

Starts with: Threat Prevention • WildFire • URL Filtering • DNS Security
Domain 3 (20%) 4 sections

AI-Powered Security

Starts with: Prisma AIRS — AI Runtime Security Overview
Domain 2 (40%) 9 sections

Access & Identity

Starts with: GlobalProtect • User-ID • Cloud Identity Engine (CIE) • SCIM
Domain 1 (40%) 2 sections

VPN & Connectivity

Starts with: Site-to-Site VPNs (IKEv1/v2) • Post-Quantum PSK (RFC 8784)
Domain 3 (20%) 4 sections

Software Firewalls: Containers & Kubernetes

Starts with: Containers & Kubernetes Primer • CN-Series Architecture
Domain 3 (20%) 10 sections

Software Firewalls: VM-Series & Public Cloud

Starts with: Cloud Network Security • Bootstrap • AWS / Azure / GCP GWLB
Domain 3 (20%) 3 sections

Cloud NGFW

Starts with: Managed Service Model • Azure vNET / vWAN • AWS Transit Gateway • Rulestacks & Panorama
Domain 1 & 2 3 sections

Resilience & Scale

Starts with: High Availability (Active/Passive & Active/Active) • Virtual Systems (VSYS)
Domain 3 (20%) 11 sections

Management & Ops

Starts with: Panorama Pre/Post-Rules • Strata Logging Service • ACC
Domain 2 (40%) 2 sections

Licensing & Summary

Starts with: Subscription Map — What's Free vs. Paid