- Design User-ID and device health, host information profile (HIP) and security posture, and Device-ID based least privilege access Security policy controls
- Design and differentiate between network segmentation and microsegmentation
- Differentiate access to specific applications
- Implement continuous security scanning of allowed traffic to stop malware and exploits
Palo Alto Networks Certification Training Course
Palo Alto Networks Certified Network Security Architect Certification Training Course
We'll get you ready for the Palo Alto Networks Certified Network Security Architect exam, the top credential in the Palo Alto Networks network security track.
Course focus: Zero Trust, AI security, centralized management and IAM, private application access, mobile users, branches, data security, IoT, public cloud and private cloud, mapped to the official blueprint.
Course Overview
What the Network Security Architect course covers and who it's for.
Per Palo Alto Networks, Network Security Architect validates the skills and experience architects need to understand technical and business requirements and design secure, highly available and scalable systems with the network security portfolio.
Palo Alto Networks notes that this is an advanced exam that assumes you know the Specialist topics. We follow the ten domains in the official datasheet and treat the course as design work, using the Specialist material as background.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of Palo Alto Networks, and this isn't official Palo Alto Networks training. Palo Alto Networks sets exam content, fees and policies, so check paloaltonetworks.com before you book.
Course Objectives
Get ready for Network Security Architect the way the exam is built.
01
Cover the Whole Blueprint
Work through all 10 domains in the official Network Security Architect datasheet, weighted the way the exam weights them.
02
Go Deep on Centralized Management and IAM
Centralized Management and IAM is 13% of the exam score per Palo Alto Networks, so it gets the most class time.
03
Practice in a Lab
Hands-on lab work on the tasks the Network Security Architect blueprint lists, not just slides.
04
Be Ready for Test Day
The exam is in person at a Pearson VUE test center with multiple choice, matching and ordering items. We practice all three.
Who Should Attend
- Network security, cloud and enterprise architects.
- Solutions architects and senior systems engineers.
- Domain consultants for network security.
- Specialist holders moving to Architect.
Prerequisites
- Palo Alto Networks recommends 5+ years designing security and networking solutions across SASE, branch, private cloud and public cloud.
- Recommended certifications include SSE Engineer, NGFW Engineer and Network Security Analyst. We don't have enrollment prerequisites.
Pathway Map
The Network Security Architect course in 10 modules.
Each module is one domain from the official datasheet, with its exam weight.
Course Content
- Differentiate between and explain the specific Palo Alto Networks products that make up Prisma AI Runtime Security (AIRS) and AI Access
- Determine recommended standard architectures for AI security
- Identify and explain the classification and attributes of AI applications and apply security controls
- Architect Panorama and log collectors
- Architect Strata Cloud Manager (SCM), Strata Logging Service, and Cloud Identity Engine
- Recommend Cloud Identity Engine directory sync options
- Recommend Strata Logging Service log forwarding methods and integrations
- Architect Prisma Access in regional and global deployments
- Differentiate between on-ramp and off-ramp architectures
- Determine private application access through Prisma Browser
- Evaluate Prisma Browser, Prisma Access Agent, explicit proxy, and GlobalProtect use cases
- Architect GlobalProtect connection methods: On-demand, User-logon (Always On), Pre-logon (Always On)
- Architect Prisma Access Mobile Users
- Design AI-Powered Autonomous Digital Experience Manager (ADEM)
- Compare and design branch architectures for SASE security and HA
- Evaluate advanced security for Prisma SD-WAN
- Differentiate between SaaS Security Inline and SaaS API Security
- Determine the most secure approach for SaaS application usage control
- Analyze and architect to Enterprise DLP functionality
- Architect Device Security
- Differentiate between IoT sensor placement options
- Explain visibility functionality
- Evaluate and design to Device-ID capabilities
- Explain NGFW standard integrations, including AWS, Azure, GCP, and OCI
- Design for maintenance and security across CSP environments
- Design to AWS NGFW standards
- Design to Azure NGFW standards
- Assess private cloud scope and capacity requirements
- Design VM-Series deployments across hypervisors
- Evaluate SSL decryption versus performance trade-offs
- Architect HA deployment for private cloud resilience
Course Features
How we teach Network Security Architect.
Instructor-Led Classes
Live instruction with time for questions, so you aren't figuring out the hard parts alone.
Hands-On Labs
Lab work tied to the tasks in the Network Security Architect blueprint.
Blueprint Mapping
Every module maps to a domain in the official Network Security Architect datasheet.
Exam Strategy
Practice with multiple choice, matching and ordering questions, plus test center tips.
Certification Exam
About the Network Security Architect exam.
Network Security Architect Exam Readiness
Our students pass at a 98.8% rate across Accumentum courses. We'll get you ready for Network Security Architect the same way.
Per Palo Alto Networks, Network Security Architect is a Architect level exam priced at $300 USD, and taxes may apply. Since August 1, 2025, Palo Alto Networks exams are delivered in person at Pearson VUE test centers only. Exams are in English, with multiple choice, matching and ordering questions.
The certification is valid for two years and you renew by retaking the exam. If you fail, the waits before retakes are 15, 30 and then 90 days. Full details are on the official Network Security Architect page.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of Palo Alto Networks, and this isn't official Palo Alto Networks training. Palo Alto Networks sets exam content, fees and policies, so check paloaltonetworks.com before you book.
Exam Blueprint
What the Network Security Architect exam covers.
This is the complete Network Security Architect blueprint from the official datasheet. 10 domains, 45 objectives, and every sub topic Palo Alto Networks calls out.
Domain 1: Zero Trust Enterprise (8%)
1.1 Design User-ID and device health, host information profile (HIP) and security posture, and Device-IDbased least privilege access Security policy controls
1.2 Design and differentiate between network segmentation and microsegmentation
1.3 Differentiate access to specific applications
1.4 Implement continuous security scanning of allowed traffic to stop malware and exploits
1.5 Implement continuous monitoring and analytics of zero trust environment
Domain 2: AI Security (11%)
2.1 Differentiate between and explain the specific Palo Alto Networks products that make up Prisma AI Runtime Security (AIRS) and AI Access
- Prisma AIRS, AI red teaming, AI model scanning, AI runtime security, AI security, AI agents
- Prisma AIRS, Kubernetes integration / microsegmentation
- AI Access, App-ID Cloud Engine, Advanced Threat Prevention, Advanced URL Filtering, Enterprise DLP
2.2 Determine recommended standard architectures for AI security
- AI products that solve specific AI architectures
- AIRS form factors
- AI security content and data security
2.3 Identify and explain the classification and attributes of AI applications and apply security controls
- Application sanctioning and controls of sanctioned applications, including data loss prevention (DLP)
- AI applications and security frameworks (that is GDPR, NIST, EU Data Act, PCI DSS, HIPAA)
Domain 3: Centralized Management and IAM (13%)
3.1 Architect Panorama and log collectors
- Panorama high availability (HA)
- Log collection resilience and redundancy
3.2 Architect Strata Cloud Manager (SCM), Strata Logging Service, and Cloud Identity Engine
3.3 Recommend Cloud Identity Engine directory sync options
- On-premises agent
- Cloud Directory / SAML 2.0, including Entra ID and Okta
3.4 Recommend Strata Logging Service log forwarding methods and integrations (for example syslog over TLS, HTTP, email)
3.5 Recommend User identification and authentication methods (for example Cloud Identity Engine, CAS for SAML)
3.6 Evaluate Cloud Identity Engine use cases
- NGFW
- Prisma Access
- Prisma SD-WAN
Domain 4: SSE Private Application Access (11%)
4.1 Architect Prisma Access in regional and global deployments
4.2 Differentiate between on-ramp and off-ramp architectures
- Service connection routing modes (default and hot-potato) and failover modes
- Zero Trust Network Access (ZTNA) Connectors (for example FQDN, wildcard, IP subnet, Connector IP Blocks, CSP scalability)
- Colo-Connect and Google Cloud Network Connectivity Center (NCC)
4.3 Determine private application access through Prisma Browser
Domain 5: Mobile User Security (7%)
5.1 Evaluate Prisma Browser, Prisma Access Agent, explicit proxy, and GlobalProtect use cases
5.2 Architect GlobalProtect connection methods: On-demand, User-logon (Always On), Pre-logon (Always On)
5.3 Architect Prisma Access Mobile Users
5.4 Design AI-Powered Autonomous Digital Experience Manager (ADEM)
Domain 6: Modernizing Branches (11%)
6.1 Compare and design branch architectures for SASE security and HA
- Prisma Access remote networks
- Prisma SD-WAN
- PAN-OS SD-WAN
- ADEM
- Third-party edge / SD-WAN
6.2 Evaluate advanced security for Prisma SD-WAN
- App-ID, Device-ID, User-ID
- Threat, URL, DNS
Domain 7: Data Security (7%)
7.1 Differentiate between SaaS Security Inline and SaaS API Security
- In-motion (inline)
- At-rest (API)
- SaaS Security Posture Management (SSPM)
- Enterprise DLP and advanced web filtering
7.2 Determine the most secure approach for SaaS application usage control
7.3 Analyze and architect to Enterprise DLP functionality
- Classifiers
- Traditional / Regex
- Exact Data Matching (EDM), Indexed Document Matching (IDM), Optical Character Recognition (OCR)
- Machine learning (ML) classification
- Endpoint DLP
- Policy-based DLP
Domain 8: Securing IoT Environments (11%)
8.1 Architect Device Security
- Visibility / discovery and risk assessment
- Enforcement
8.2 Differentiate between IoT sensor placement options
8.3 Explain visibility functionality (for example NGFW, virtual metadata collector, Prisma SD-WAN, PAN-OS SD-WAN)
8.4 Evaluate and design to Device-ID capabilities
8.5 Confirm and design to Device Security capabilities
Domain 9: Public Cloud (11%)
9.1 Explain NGFW standard integrations, including AWS, Azure, GCP, and OCI
9.2 Design for maintenance and security across CSP environments
- Maintenance and OS upgrade process
- VPN termination
- SSL decryption
- Centralized / decentralized architectures
9.3 Design to AWS NGFW standards
- Insertion options, AWS Gateway Load Balancer (GWLB), Transit Gateway Connect
- HA and high resilience
- NGFW subinterfaces
9.4 Design to Azure NGFW standards
- Insertion options and load balancer
- HA and high resilience
9.5 Design to GCP NGFW standards
- Insertion options and load balancer
- HA and high resilience
9.6 Justify VM-Series and Cloud NGFW solutions
- Cloud NGFW use cases
- VM-Series use cases
Domain 10: Private Cloud (PA-Series, VM-Series, Hypervisors) (10%)
10.1 Assess private cloud scope and capacity requirements
- Edge
- Core
- East-west uSeg
10.2 Design VM-Series deployments across hypervisors (for example AHV, KVM, ESXi)
- Resource allocation strategy per hypervisor type
- Hardware offload and scaling for encrypted traffic
- vCPU sizing, hyperthreading, NUMA placement
- Data Plane Development Kit (DPDK), SR-IOV
10.3 Evaluate SSL decryption versus performance trade-offs
10.4 Architect HA deployment for private cloud resilience
- HA options (for example active/passive, active/active)
- Hardware firewall clustering (4th vs. 5th generation silicon)
- Software firewall Hyperscale Security Fabric (HSF)
- Fast failover guidelines for UDP and TCP applications
10.5 Explain Layer 3 deployment routing considerations
- Redistribution (that is ECMP, static routing, and BGP and OSPF dynamic routing)
- Routing design
10.6 Evaluate systems management options and considerations
10.7 Evaluate new hardware deployment trending and scoping
10.8 Evaluate SSL inspection sizing requirements
Before You Start
What you should know before Network Security Architect.
Here is who Palo Alto Networks says the Network Security Architect exam is for and what it expects you to bring, taken from the official datasheet.
Who Palo Alto Networks wrote this exam for
This exam is designed for individuals with the following job roles:
- Network security architect
- Principal architect, network security
- Cloud security architect
- Data security architect
- AI security architect
- Cybersecurity architect
- Enterprise architect
- Solutions architect
- Domain consultant, Strata
- Domain consultant, network security
- Senior systems engineer, network security
- Senior solutions consultant, network security
Knowledge, skills and abilities
- Advanced knowledge of network security
- Working knowledge of TCP/IP and how traffic is directed within a network
- Advanced knowledge of networking infrastructure, protocols, and topology
- Understanding of endpoint OS fundamentals and security hardening methods
- Working knowledge of NGFWs and security automation technology
- Working knowledge of current and emergent trends in information security
- Understanding of common security industry standard principles (that is defense-in-depth, zero trust, separation of duties)
- Engineering-level competency of all NGFW offerings
- Engineering-level competency of all Prisma Access offerings
- Engineering-level competency of all Prisma SD-WAN offerings
- Advanced knowledge of reference architectures describing how Palo Alto Networks solutions come together to solve customer problems
- Advanced knowledge of enabling sales and presales (including partners) to effectively position use case-based solutions based on sound architectural principals
Recommended background
Recommended work experience: 5+ years designing, implementing, and troubleshooting security and networking solutions in SASE, Branch Networking, and both on-premises Private Cloud and Public Cloud (CSP) environments, 2+ years with Palo Alto Networks architecture and solutions.
Recommended certifications first: Palo Alto Networks Certified Security Service Edge Engineer, Palo Alto Networks Certified Next-Generation Firewall Engineer, Palo Alto Networks Certified Network Security Analyst, Palo Alto Networks Certified SD-WAN Engineer.
Study Plan
How we approach Network Security Architect prep.
Centralized Management and IAM carries 13% of the exam, more than any other domain, so we spend the most lab and review time there.
Palo Alto Networks products change often, and the exam follows the current release. Read the release notes for anything you use in the lab so you aren't studying an old screen.
Our course follows the same blueprint, with on demand lessons you can pause and replay, and our students pass at a 98.8% rate across Accumentum courses.
Exam Policies
What happens before and after the Network Security Architect exam.
Once you pass Network Security Architect, the certification stays valid for two years. Palo Alto Networks recertification means retaking the current exam.
Passing a higher level exam in the same track automatically extends your active lower level certifications in that track by two years. For Network Security Architect that can include an active Network Security Professional, Cybersecurity Practitioner or Cybersecurity Apprentice certification.
If you don't pass, you get a results report broken down by domain. Palo Alto Networks requires a 15 day wait before a second attempt, 30 days before a third and 90 days before any attempt after that. After a pass you can't sit the same exam again for 18 months.
Exams are delivered in English through Pearson VUE, and candidates testing in non English speaking countries get a 30 minute time extension by default. Your badge and certificate come through Credly.
Career Outcomes
Jobs that line up with Network Security Architect.
Network Security Architect is the top credential on the network security side. It fits network security architects, cloud and data security architects and senior consultants who design across firewalls, SASE, cloud and IoT.
Per the U.S. Bureau of Labor Statistics, computer network architects earned a median annual wage of $134,050 in May 2025. A median is the midpoint, so half earned more and half earned less, and your own pay will depend on location, experience and employer. Source: BLS Occupational Outlook Handbook.
Funding
Ways to pay for Network Security Architect training.
Our funding page lays out every way to pay for training, and PathPay lists the courses that qualify for a monthly plan.
Veterans can look at VR&E benefits for career training, and our Veteran Skill Forge programs bundle several courses into one path. Questions about your situation? Contact us and we'll talk it through.
Frequently Asked Questions
Common questions about our Network Security Architect course.
Palo Alto Networks Certified Network Security Architect is a Architect level certification from Palo Alto Networks. Details are on the official certification page at https://www.paloaltonetworks.com/services/education/palo-alto-networks-netsec-architect.
No. We're an independent training provider and we aren't a Palo Alto Networks partner. Our course follows the public exam blueprint in the official datasheet. Palo Alto Networks offers its own learning paths at learn.paloaltonetworks.com.
Palo Alto Networks lists Architect exams at $300 USD, and taxes may apply. Vouchers are sold through Pearson VUE and expire 12 months after purchase. Check the current price before you buy.
No. Since August 1, 2025, Palo Alto Networks certification exams are delivered in person at Pearson VUE test centers only.
Two years from the date you pass. You renew by retaking the exam, and passing a higher level exam in the same track renews your active lower level certifications.
Palo Alto Networks recommends 5+ years designing security and networking solutions across SASE, branch, private cloud and public cloud. Recommended certifications include SSE Engineer, NGFW Engineer and Network Security Analyst. We don't have enrollment prerequisites.
Instructor-led, with hands-on labs and practice questions. Ask us about upcoming class dates.
Use the registration page linked below, or email info@accumentum.net and we'll follow up with dates and next steps.
10. Per the official datasheet they are Zero Trust Enterprise (8%), AI Security (11%), Centralized Management and IAM (13%), SSE Private Application Access (11%), Mobile User Security (7%), Modernizing Branches (11%), Data Security (7%), Securing IoT Environments (11%), Public Cloud (11%), Private Cloud (PA-Series, VM-Series, Hypervisors) (10%).
Centralized Management and IAM at 13%, per the Palo Alto Networks datasheet.
Recommended work experience: 5+ years designing, implementing, and troubleshooting security and networking solutions in SASE, Branch Networking, and both on-premises Private Cloud and Public Cloud (CSP) environments, 2+ years with Palo Alto Networks architecture and solutions.
Palo Alto Networks recommends Palo Alto Networks Certified Security Service Edge Engineer, Palo Alto Networks Certified Next-Generation Firewall Engineer, Palo Alto Networks Certified Network Security Analyst and Palo Alto Networks Certified SD-WAN Engineer. They aren't required.
Palo Alto Networks lists network security architect, principal architect, network security, cloud security architect, data security architect, AI security architect, cybersecurity architect, enterprise architect, solutions architect, domain consultant, Strata, domain consultant, network security, senior systems engineer, network security and senior solutions consultant, network security.
Palo Alto Networks requires a 15 day wait after a first failed attempt, 30 days after a second and 90 days after a third. Once you pass, you can't retake the same exam for 18 months.
Our PathPay page lists the courses that qualify for a monthly plan. For anything else, contact us and we'll go over options.
Enrollment
Enroll in Network Security Architect training with Accumentum.
Enroll in our Network Security Architect course to get ready for the Palo Alto Networks Certified Network Security Architect exam with instructor-led classes and hands-on labs.
For dates and next steps, use the registration page linked below or email info@accumentum.net.
Ready to start on Network Security Architect?
Tell us your target date and we'll help you plan the path.