Palo Alto PCNSA & PCNSE: Network Security Certs in 2026

Why Palo Alto Networks updated both exams for PAN-OS 11

PAN-OS 11.0 was a landmark release for Palo Alto Networks. It introduced machine-learning models running natively on the firewall data plane — a fundamental shift from signature-based threat detection to inline ML inference that classifies never-before-seen threats without a cloud lookup. PAN-OS 11.1 extended this with Advanced Threat Prevention v3, which applies deep learning models to encrypted traffic without decryption, and overhauled the Advanced DNS Security engine to detect DNS-based command-and-control at millisecond latency.

The previous exam versions, which described PAN-OS 10.x behaviour, could not adequately test these capabilities. An administrator managing a PAN-OS 11 environment without understanding how ML security profiles differ from traditional AV/anti-spyware profiles, or without knowing when inline cloud analysis is triggered versus on-device inference, is not prepared for the operational realities of modern Palo Alto deployments. The exam updates bring the testing content in line with what is actually running in production networks today.

Both PCNSA and PCNSE now have exam versions explicitly tied to PAN-OS 11.0/11.1. Legacy exam versions against PAN-OS 10.x software are still available at some testing centres during the transition window, but candidates beginning study in 2026 should target the PAN-OS 11 versions exclusively — the older version exams will be retired on a rolling basis as testing demand drops.

PCNSA vs PCNSE at a glance

PCNSA: what the updated exam tests

The PCNSA exam is designed for network security administrators who work with Palo Alto Networks firewalls daily — configuring policies, monitoring logs, managing Security profiles, and keeping the environment operational. The updated exam covers six primary domains.

PCNSE: what the updated exam tests

The PCNSE covers the full PCNSA domain set at greater depth plus five additional engineering-level domains that PCNSA does not test. The distinction is not just complexity — PCNSE candidates are expected to design solutions, not just operate them. The exam includes scenario-based questions where the candidate must select the correct architectural approach from multiple plausible options, not just identify a correct configuration fact.

What changed between PAN-OS 10 and PAN-OS 11 exam versions

Candidates who prepared for PCNSA or PCNSE against PAN-OS 10 study material will find approximately 60–70% of the underlying knowledge transferable. The App-ID engine, Security policy fundamentals, NAT types, and Panorama device group model have not changed conceptually. The areas requiring fresh study are:

• ML Security Profiles — on-device inference, confidence thresholds, unknown threat handling. Absent in PAN-OS 10 exams.
• Advanced DNS Security — DNS proxy inspection, command-and-control domain detection, DNS Security log analysis. The PAN-OS 10 DNS proxy content was tested at a surface level; PAN-OS 11 tests it as a first-class threat prevention layer.
• Cloud Identity Engine — replaces the legacy on-premise User-ID agent for cloud directory sources. The configuration model is fundamentally different from AD agent-based User-ID.
• AI-Ops for NGFW — entirely new in PAN-OS 11. Not present in any earlier exam version.
• ZTNA 2.0 — new architecture domain in PCNSE; conceptual awareness tested in PCNSA.

Plan for 20–30 additional study hours if you have PAN-OS 10.x experience and are transitioning to the PAN-OS 11 exam versions. The operational core is familiar, but the ML security layer and ZTNA 2.0 architecture require hands-on lab time — they do not map cleanly to any earlier Palo Alto Networks concept.

The Palo Alto Networks certification path

PCNSA and PCNSE sit at the base of the Palo Alto Networks practitioner path. Beyond them, the program branches into specialist credentials for cloud, SASE, and SOC use cases.

Neither PCCSE nor PCSAE require PCNSE as a formal prerequisite, but Palo Alto Networks recommends PCNSE as preparation for PCCSE — the cloud security engineer exam assumes PAN-OS firewall literacy as background knowledge, not as testable content. PCSAE candidates who do not hold PCNSE are recommended to complete the official SASE training course before sitting the exam.

Renewal: how two-year validity works in practice

Both PCNSA and PCNSE are valid for two years from the date of passing. Renewal before expiry requires either retaking the exam or completing a specified set of Palo Alto Networks continuing education credits through the official education portal. The credits pathway was introduced to reduce the burden on experienced engineers who are current with PAN-OS developments through their work but find the prospect of resitting a 75-question exam every two years disproportionate to their skill level.

Palo Alto Networks has not announced a grace period or extension policy for expired credentials. An expired PCNSA or PCNSE must be retaken from scratch — there is no reduced-scope renewal exam. Engineers who let their PCNSE lapse and attempt to re-certify against the current PAN-OS 11 exam version should plan for 40–60 hours of preparation if they have remained current with PAN-OS through their work, and 80–100 hours if they have spent time outside of Palo Alto Networks environments.

Who should prioritise PCNSA vs PCNSE in 2026

Network security administrators working inside Palo Alto Networks environments — applying policy changes, reviewing threat logs, managing GlobalProtect users, and responding to WildFire verdicts — should target PCNSA first. The exam validates the operational competencies that define day-to-day firewall administration and is the appropriate entry point for professionals transitioning from other NGFW platforms (Cisco ASA, Fortinet FortiGate, Check Point) who need to demonstrate platform-specific competence to employers.

Security engineers who design network architectures, integrate Palo Alto firewalls with cloud platforms, manage Panorama estates of ten or more devices, or troubleshoot complex multi-domain policy interactions should target PCNSE. The exam is also the correct preparation credential for engineers moving into Palo Alto Networks professional services roles or joining MSSPs that manage Palo Alto environments for enterprise customers. In the MSSP market specifically, PCNSE has become a standard hiring bar for senior security engineers — many job descriptions list it alongside CISSP or CCNP Security as a required rather than preferred qualification.