PCNSE used to be the one line on a resume that told a hiring manager you understood Palo Alto Networks firewalls end to end. That single-exam era is over. Palo Alto Networks retired PCNSE on July 31, 2025 and pulled PCNSA slightly ahead of it, replacing both with a role-based credential system built around three tracks and four levels instead of one flagship test.<\/p>\n
By September 2026 that replacement system is not a roadmap slide anymore. It is fully staffed with live exams, current question banks, and real candidates sitting them at Pearson VUE test centers every week. The Palo Alto Networks category on DirectCertify now carries 37 exams, and most people searching for this topic just want an answer to one narrow question: if there’s time for exactly one exam right now, which one actually matches the job being done or the job being chased next. This piece works through the three certifications getting the most attention, NGFW Engineer, Network Security Professional (NetSec Pro), and XDR Analyst, with real cost, format, and career-fit detail for each.<\/p>\n
Palo Alto Networks’ own certification program page<\/a> lays out the reasoning plainly: the company’s product line grew from a firewall-centric platform into something that spans Prisma Access, Cortex XDR, and cloud-delivered security services, and a single generalist exam could no longer validate meaningful depth across all of it. The fix was a role-based framework organized around three certification tracks, each mapped to how security teams are actually structured day to day, and totaling 14 distinct credentials once every level and track is counted.<\/p>\n Each track then runs through four competency levels, Foundational, Professional, Specialist, and Architect, so a credential can signal exactly how deep someone has gone rather than lumping a first-year analyst and a ten-year architect under the same badge. NGFW Engineer and XDR Analyst both sit at the Specialist level in their respective tracks, while NetSec Pro sits one level down at Professional, a distinction that matters more than it sounds once cost and depth of coverage come into play later in this piece.<\/p>\n According to Red Education, a long-running Palo Alto Networks training partner, PCNSE was formally withdrawn on July 31, 2025, with PCNSA pulled from availability just ahead of it as part of the same restructure. DirectCertify covered the initial retirement announcement in detail in an earlier post on what replaced PCNSE and PCNSA<\/a> when the change first landed, and the practical mechanics of that transition are worth revisiting now that the replacement exams have over a year of real candidate activity behind them.<\/p>\n There is no bridge exam and no automatic upgrade. Existing PCNSE and PCNSA holders keep their credentials active until the original two-year expiration date on file, but when that date arrives, recertification means sitting the full current exam rather than a shortened refresher.<\/p>\n That last point matters for anyone job hunting right now. A posting asking for PCNSE in late 2026 is very likely describing NGFW Engineer-level work using outdated terminology, not a sign the old exam is somehow still the target credential. It’s also worth noting there’s no discount for recertifying. Someone renewing off an expired PCNSE pays the same $250 NGFW Engineer exam fee as a brand-new candidate walking in with zero prior Palo Alto Networks credentials, since the restructure eliminated any reduced-scope renewal option along with the old exam itself.<\/p>\n NGFW Engineer is the closest thing to a straight-line replacement for PCNSE, and it is the credential most existing PCNSE holders will land on by default. The official exam runs 90 minutes with roughly 75 scenario-based questions and an 860 out of 1000 passing score, delivered exclusively in person at Pearson VUE test centers rather than through online proctoring.<\/p>\n NGFW Engineer sits at the Specialist tier, priced at $250 through the official Pearson VUE voucher store<\/a>. DirectCertify’s own NGFW Engineer practice test set<\/a> was last refreshed on September 12, 2026 to version 6.2, currently running 125 questions across single and multiple choice formats, a useful signal that this specific exam is still being actively updated rather than left stagnant after launch.<\/p>\n NGFW Engineer tests hands-on configuration work across four core areas:<\/p>\n It fits people who spend their actual workday inside firewall consoles, not people who only touch Palo Alto tooling occasionally as part of a broader network security role.<\/p>\n Network Security Professional, shortened to NetSec Pro almost everywhere it’s discussed online, sits one rung below NGFW Engineer in Palo Alto’s level system but covers more ground horizontally. Where NGFW Engineer goes deep on firewall administration specifically, NetSec Pro spans NGFW fundamentals plus Prisma Access and SASE architecture, aimed at people managing a security environment rather than living inside one product’s configuration screens all day.<\/p>\n As a Professional-tier exam, NetSec Pro costs $200, fifty dollars less than either Specialist-tier exam in this comparison. DirectCertify’s own NetSec Pro practice test set sits at version 6.1, 73 questions, last updated September 7, 2026, the lightest of the three in raw question count but still current within the past two weeks of this writing.<\/p>\n This one fits network security generalists and team leads who need working knowledge across firewalls, SASE, and Prisma Access without needing to be the single deepest firewall configuration expert on the team. It’s also a reasonable first Palo Alto credential for someone new to the vendor’s ecosystem who isn’t ready to commit to a Specialist-level exam yet, and unlike NGFW Engineer, Palo Alto Networks doesn’t publish a recommended minimum years of hands-on experience for it, though the exam content still assumes real working familiarity with the platform rather than classroom-only exposure.<\/p>\n XDR Analyst replaced the older PCDRA credential and moved into the Security Operations track rather than Network Security, which is the clearest sign of how differently Palo Alto Networks now separates firewall engineering from SOC-facing work. It focuses on Cortex XDR specifically: alert triage, investigation workflows, and response actions rather than anything related to firewall policy.<\/p>\n XDR Analyst is also priced at the $250 Specialist tier. DirectCertify’s XDR Analyst prep material<\/a> currently sits at version 6.0, 91 questions, last updated September 11, 2026.<\/p>\n SOC analysts, threat hunters, and incident responders working inside Cortex XDR day to day are the intended audience here, not network engineers. Anyone comparing this against similar SOC-analyst-facing credentials from other vendors may also want to look at CrowdStrike’s newer Certified SIEM Analyst exam<\/a>, which validates a comparable next-gen detection and response skill set on a different platform.<\/p>\n Laid out together, the cost and depth differences between the three become easier to weigh at a glance than reading three separate sections back to back.<\/p>\n\n
What Actually Happened to PCNSE and PCNSA Holders<\/h2>\n
The Retirement Timeline<\/h3>\n
The Transition Path for Existing Holders<\/h3>\n
\n
The Three Certifications Getting the Most Attention Right Now<\/h2>\n
NGFW Engineer: The Direct Firewall-Engineering Successor<\/h3>\n
Exam Format and Cost<\/h4>\n
Who Should Take It<\/h4>\n
\n
NetSec Pro: Broader Network Security Without the Deep Firewall Focus<\/h3>\n
Exam Format and Cost<\/h4>\n
Who Should Take It<\/h4>\n
XDR Analyst: The Detection-and-Response Track<\/h3>\n
Exam Format and Cost<\/h4>\n
Who Should Take It<\/h4>\n
Side-by-Side Comparison<\/h2>\n