The PCNSA is the Palo Alto Networks Certified Network Security Administrator exam, aimed at people who configure and operate next-generation firewalls. This page gives you free practice sets grouped by topic, the exam format and scoring from the official sources, worked explanations of sample questions, and a study plan. Start the practice test whenever you are ready.
The PCNSA has 75 questions and takes about 80 minutes[1] (Palo Alto Networks, verified Oct 29, 2026).
Numbers in brackets link to the official sources listed under Sources & last verified. Dates that have passed are removed automatically.
| Item | Detail | Source · Verified |
|---|---|---|
| Number of questions | 60–75 questions[1] | paloaltonetworks.com · Oct 29, 2026 |
| Time limit | 80 minutes (90 minutes total appointment)[1] | paloaltonetworks.com · Oct 29, 2026 |
| Passing score | 860 (scaled score from 300 to 1000)[2] | paloaltonetworks.com · Oct 29, 2026 |
| Validity | 2 years[3] | live.paloaltonetworks.com · Oct 29, 2026 |
| Renewal | Recertify prior to expiration[2] | paloaltonetworks.com · Oct 29, 2026 |
| Delivery | In-person test centers and OnVUE online proctoring[4] | Palo Alto Networks · Oct 29, 2026 |
| Eligibility | No prerequisites; 2–3 years networking/security experience and 6 months NGFW experience recommended[1] | paloaltonetworks.com · Oct 29, 2026 |
| Score release | Provisional immediately; official once data forensics review completes[2] | paloaltonetworks.com · Oct 29, 2026 |
According to Palo Alto Networks, “For ALL Palo Alto Networks Certification exams, the converted raw passing score is 860 on a scale of 300 to 1000.”[2]
The PCNSA exam checks whether you can administer a Palo Alto Networks firewall: manage devices, build objects, write and evaluate policy, and secure traffic. The official body is Palo Alto Networks, and its study guide and certification handbook are the authority on every detail below.
Eligibility. There are no prerequisites. The study guide recommends 2–3 years of networking or security experience and some hands-on time with the firewall platform, around 6 months of NGFW experience.
Format. The exam has 60–75 questions. You get 80 minutes to answer them, inside a 90 minute appointment that also covers reviewing the NDA and a short survey at the end.
Delivery. You can sit it at a test center or online with OnVUE proctoring. Review the OnVUE system requirements, ID policy and workspace rules before exam day.
Scoring. The passing score is 860 on a scaled range of 300 to 1000. Results are provisional immediately and become official once the data forensics review completes.
Validity and renewal. A certification stays valid for 2 years from the date of issue. To keep it active you recertify by retaking the exam before it expires.
Retake waiting periods and fees are not listed here, so check the official handbook and the Pearson VUE page for current terms.
The content areas below are copied from the official PCNSA content outline published by Palo Alto Networks, with the share of the exam each area carries. The right-hand column shows which of our practice sets covers it.
| Official content area | Weight | Practice on this site |
|---|---|---|
| Device Management and Services[5] | 22% | PCNSA Configuration and Management Practise initial configuration, administrator roles, system services and how to keep a firewall managed and updated. |
| Managing Objects[5] | 20% | PCNSA Threat Prevention Practise address and service objects, tags and security profiles, and know which profile type handles which kind of threat. |
| Policy Evaluation and Management[5] | 28% | PCNSA Security Policies and Zones Practise how rules are matched top to bottom, how zones shape traffic flow, and how to read why a session was allowed or denied. |
| Securing Traffic[5] | 30% | PCNSA WildFire and Malware Analysis Practise malware analysis, threat prevention and decryption concepts so you can match a threat to the right control. |
Prepare for the PCNSA - Palo Alto Networks Certified Network Security Administrator exam with our free practice test modules. Each quiz covers key topics to help you pass on your first try.
These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.
Question: Which Palo Alto Networks feature allows a GlobalProtect gateway to enforce Host Information Profile (HIP) checks?
Answer: B. HIP-based policy enforcement
Explanation:
HIP-based policy enforcement is correct because the GlobalProtect agent reports endpoint posture, such as patch level or security software status, and the gateway can use that report in policy to allow or restrict access. Security policy tag matching is wrong because tags are labels that help you organise and find rules; they do not evaluate a device's health. A URL filtering profile is wrong because it controls web categories, not the state of the connecting endpoint. A DoS Protection profile is wrong because it defends against flood-style traffic, not device compliance. The rule to remember: if the question is about the condition of the device connecting, think HIP; if it is about the content or volume of traffic, think profiles.
Question: What is the purpose of the Antivirus security profile on a Palo Alto Networks firewall?
Answer: B. Detect and block malware in network traffic
Explanation:
The Antivirus profile is there to detect and block malware in network traffic, which is why that option is correct. Blocking access to malicious URLs belongs to URL filtering and related web controls, so that option describes a different profile. Preventing command-and-control communications is the job of anti-spyware style protections, which look for infected hosts calling out. Identifying and blocking known exploits is the job of Vulnerability Protection, which watches for attacks against software flaws. The general rule: match the threat type to the profile built for it. Files and malware point to Antivirus, malicious sites to URL filtering, callbacks to anti-spyware, and exploit attempts to Vulnerability Protection.
Question: What should you do when troubleshooting a system architecture issue?
Answer: B. Follow a systematic approach: identify, research, test, implement, verify
Explanation:
The correct answer is to follow a systematic approach: identify the problem, research it, test a fix, implement it and verify the result. This works because each step narrows the cause and confirms the fix did not break something else. Restarting all systems immediately is wrong because it can destroy the evidence you need and disrupts users without explaining anything. Making random changes until the problem goes away is wrong because you cannot tell which change helped, and you may add new faults. Escalating everything without investigation is wrong because it hands over a problem you have not described. The rule to remember: change one thing at a time, record what you did, and confirm the outcome before closing the issue.
Start with the official PCNSA study guide and read the list of content areas, so you know what the exam covers. Then take a short practice set from each area in the table above, without notes, to find where you are weakest. Do not worry about the score on this first pass; its purpose is to give you a list of topics to fix.
Next, work through your weakest sets one at a time. After every question, read the explanation even when you got it right, and write down the rule behind the answer in your own words. If a topic keeps tripping you up, open the firewall or a lab environment and do the task by hand, because administrator exams reward people who have actually clicked through the interface.
Spend extra time on policy evaluation and security profiles. Many wrong answers come from mixing up which profile or rule type handles which job, so build a small comparison table and revisit it.
In the final days, take the full practice test under timed conditions. Review every miss, and reread the OnVUE or test center rules so exam day holds no surprises. These sets are written by us with AI tools and are not real exam questions, so treat them as practice for understanding, not as a preview of the exam.
The passing score is 860 on a scaled range of 300 to 1000. Palo Alto Networks states that this converted raw passing score applies to all of its certification exams. Because scores are scaled, you cannot read the number as a simple percentage of correct answers.
The exam has 60–75 questions and you have 80 minutes to complete them. The full appointment is 90 minutes, which includes time to review the NDA before the exam and to complete a short survey at the end.
No prerequisites are required. Palo Alto Networks recommends 2–3 years of experience in networking or security, plus around 6 months of hands-on experience with its firewall products. These are recommendations, so you can register without them, but they help a great deal.
Yes. You can take it at a test center or online with OnVUE proctoring through Pearson VUE. Before booking, review the OnVUE system requirements, testing rules, ID policies and workspace setup so a technical or room issue does not interrupt your attempt.
An active certification remains valid for 2 years from the date of issue. To keep it active you must recertify by retaking the exam before the expiration date. Check the official handbook for current renewal details.
Your result is provisional immediately after the exam. It becomes official once the data forensics review has completed, and Palo Alto Networks then contacts you by email. Timing can vary, so use the official handbook as the source for current process details.
How we verify: editorial & fact-checking policy. Report an error: contact us.