How Difficult Is Palo Alto Networks NetSec-Pro? Prerequisites, Experience, and Readiness Signals

 

NetSec-Pro is difficult in a specific way: it is broad enough to punish narrow preparation, but it is not designed as a deep specialist exam in only one Palo Alto Networks product. The June 2026 Network Security Professional blueprint spans next-generation firewalls, Prisma SASE, cloud-delivered security services, centralized management, identity and device context, remote-user connectivity, data protection, AI-related security risks, and even post-quantum security concepts. A candidate can therefore be very comfortable with one firewall interface and still feel underprepared when the exam shifts to Prisma Access, Strata Cloud Manager, Enterprise DLP, SaaS Security, or platform-level decision making.

That breadth changes how difficulty should be judged. The useful question is not simply whether NetSec-Pro is ‘easy’ or ‘hard.’ The better question is whether your current experience matches the decisions the blueprint expects you to reason through. A network engineer who has years of routing and firewall experience may move quickly through segmentation, policy, certificates, NAT, and logging but need extra work on Prisma SASE and Cloud-Delivered Security Services. A candidate who has completed digital training may recognize every product name yet struggle when a scenario asks which control, management plane, identity signal, or connectivity model fits a particular business requirement.

This guide explains the real sources of difficulty, what Palo Alto Networks currently expects candidates to know, what counts as a practical prerequisite even when no prior certification is stated, and how to decide whether you are actually ready to schedule the exam. The aim is not to create an artificial barrier. It is to replace vague confidence with observable readiness signals.

Start with what the current exam actually expects

The June 2026 Palo Alto Networks Network Security Professional datasheet describes the certification as a professional-level credential that validates understanding of the organization’s network security products and services, their use cases, and their application to an organization. It also validates entry-level use, maintenance, configuration, installation, and deployment. The current exam is listed as 90 minutes, multiple choice, delivered in English through Pearson Professional Assessments, with a listed price of $200 USD that may vary by country.

Those details matter because they frame the exam correctly. NetSec-Pro is not a pure terminology test, but it is also not the same thing as a product-engineer practical exam. The blueprint repeatedly uses verbs such as explain, identify, and describe. That means you should expect to distinguish technologies, interpret scenarios, understand operational consequences, and know how Palo Alto Networks components fit together. You are not preparing to reproduce an entire production configuration from memory.

Coverage is uneven by design. The largest share, 30 percent, belongs to Platform Solutions, Services, and Tools. Two areas each account for 17 percent: Network Security Fundamentals and Infrastructure Management and CDSS. NGFW and SASE Solution Functionality and Connectivity and Security each carry 13 percent, while NGFW and SASE Solution Maintenance and Configuration accounts for the remaining 10 percent. That distribution explains why candidates who prepare only around firewall configuration often feel surprised: most of the scoring weight sits outside a narrow device-administration view.

Why NetSec-Pro feels harder than its ‘Professional’ label suggests

Professional-level in the current Palo Alto Networks certification portfolio means broad operational and management knowledge across a platform. It does not mean the exam is trivial or suitable only for beginners. The challenge is context switching. You may move from packet inspection to decryption, then from Cloud NGFW to Prisma SD-WAN, then to AIOps, Enterprise DLP, Strata Cloud Manager, remote-user connectivity, and certificate use. The underlying security principles connect these topics, but the product roles are different enough that memorizing one interface is not sufficient.

Another source of difficulty is that many objectives are relational. You need to know not only what a component does, but where it belongs in an architecture and why it would be selected. Consider Panorama and Strata Cloud Manager. Recognizing both names is easy. Explaining when centralized management matters, what types of environments they manage, how reporting and configuration management fit the operating model, and how management choices affect visibility is more demanding. The same pattern appears with Prisma Access, Prisma SD-WAN, Cloud NGFW, PA-Series, VM-Series, CN-Series, and the various Cloud-Delivered Security Services.

The exam also includes subjects that may be outside the daily routine of otherwise experienced firewall administrators. The June 2026 blueprint explicitly includes Next-Generation Trust Security, quantum-security risks such as harvest-now-decrypt-later, and AI-related security risks and mitigations. These topics are not necessarily deep cryptography or AI engineering questions. Their difficulty comes from forcing candidates to understand how newer security concerns map to platform capabilities and enterprise controls.

Are there formal prerequisites?

The current NetSec-Pro datasheet does not state that you must first hold another Palo Alto Networks certification. Instead, it identifies a target audience and a set of skills required. That distinction is important. A missing prerequisite exam does not mean a missing prerequisite skill set. You may be allowed to register without another credential, but you still need enough networking and security context to understand why the platform behaves as it does.

The target audience includes networking and security professionals responsible for installing, deploying, operating, or administering Palo Alto Networks next-generation firewalls, Cloud-Delivered Security Services, Next-Generation Trust Security components, SASE products such as Prisma Access and Prisma SD-WAN, and management products including Strata Cloud Manager. It also includes people responsible for security and connectivity across data centers, branches, campuses, remote users, internet-connected devices, and data-handling environments.

The skills section is even more useful as a readiness baseline. Palo Alto Networks calls for basic knowledge of securing networks of all sizes; configuration of Strata and Prisma SASE products for security outcomes; management options such as Panorama and Strata Cloud Manager; relevant firewall and cloud products; NGTS products and solutions; and best practices for Strata and SASE. Treat those statements as practical prerequisites. If several of them are unfamiliar rather than merely rusty, your preparation should begin with foundations and hands-on orientation rather than exam-style questions.

The networking baseline you should have before serious exam preparation

You do not need to be a carrier-routing specialist, but you should understand how traffic moves through an enterprise network. That includes IP addressing and subnets, routing decisions, interfaces, zones, NAT, DNS, TLS, certificates, VPN concepts, segmentation, high availability, and the difference between north-south and east-west traffic. You should be able to follow a connection from a source through a security control to a destination and ask what identity, application, policy, and content inspection decisions occur along the path.

This baseline is especially important because several blueprint objectives assume that networking mechanics are already available to you as mental tools. Slow-path and fast-path inspection make more sense when you understand session establishment. Decryption choices make more sense when you understand TLS direction and trust. Security-policy and NAT reasoning becomes clearer when you can separate addressing, application identification, zones, and policy intent. Remote-user security is easier to reason about when you understand how user traffic reaches private applications, SaaS services, and the public internet.

A good self-test is to draw three traffic flows without documentation: a branch user accessing a SaaS application, a remote user accessing a private application, and an internet client reaching a published application in a data center. For each flow, mark where identity is learned, where policy is enforced, where address translation may occur, where decryption could be applied, where logs are generated, and where a certificate decision matters. If you cannot build a coherent diagram, study the traffic mechanics before worrying about memorizing product catalogs.

The security baseline matters more than product memorization

A candidate can memorize that App-ID identifies applications, User-ID maps users, Device-ID adds device context, and Content-ID inspects content, yet still miss scenario questions if those controls are treated as isolated facts. The exam is easier when you understand the security problem each control solves. Application awareness improves policy precision. User and device context reduce reliance on IP addresses alone. Decryption restores inspection visibility for encrypted traffic. Zones and segmentation constrain trust boundaries. Security profiles apply protections to allowed traffic rather than replacing the policy decision itself.

Zero Trust is another example. It should not be reduced to a slogan. In practical reasoning, Zero Trust means continually limiting access based on verified context and explicit policy rather than granting broad trust because traffic is ‘inside.’ That principle connects user identity, device identity, application identification, segmentation, authentication, decryption, logging, and least privilege. Once you see the connection, many separate blueprint terms become part of one control model.

This is why candidates with general cybersecurity experience often adapt well even when their Palo Alto Networks product exposure is limited. They already understand the problems. Their task is to map familiar security goals to Palo Alto Networks implementation options. Candidates with product exposure but weak security fundamentals face the opposite challenge: they know where settings live but may not understand why one design is safer, more scalable, or easier to operate.

How much hands-on experience is enough?

There is no single number of months that guarantees readiness because the quality of experience matters more than elapsed time. Someone who has spent a year only reviewing firewall logs may have less relevant exposure than someone who has spent three months deliberately building policies, testing App-ID behavior, troubleshooting user mapping, comparing management options, and working through remote-access and SASE scenarios.

For NetSec-Pro, useful hands-on experience means being able to perform or at least clearly explain common operational tasks. You should understand how a security rule is structured, how security profiles relate to an allowed session, how NAT changes addressing, how logging supports investigation, how objects and policies are managed, how updates and upgrades affect operations, and how centralized management helps scale consistent configuration. You should also know what changes when the environment moves from a physical firewall to VM-Series, CN-Series, Cloud NGFW, Prisma Access, or Prisma SD-WAN.

The strongest experience is comparative. If you can explain the difference between configuring a single appliance and managing many devices centrally, or between securing a branch with an NGFW and delivering security through Prisma Access, you are building the type of judgment the blueprint rewards. If your experience is limited to one deployment model, use labs, documentation, demonstrations, and architecture exercises to fill the adjacent gaps.

The biggest difficulty: breadth across NGFW and SASE

Many candidates are strongest on the classic firewall side of the portfolio. They understand PA-Series appliances, security rules, NAT, App-ID, User-ID, threat prevention, URL controls, and logging. The exam becomes harder when it asks them to transfer those same security goals into cloud-delivered and SASE contexts. Prisma Access is not just ‘a firewall in the cloud,’ and Prisma SD-WAN is not simply another routing feature. Each product solves a different operational problem and changes where connectivity, enforcement, management, and visibility live.

A practical way to handle this breadth is to organize products by job rather than by marketing name. Ask five questions: What connects? What enforces policy? What provides identity or device context? What delivers security services? What manages and observes the environment? A PA-Series appliance, a Cloud NGFW, Prisma Access, Prisma SD-WAN, Strata Cloud Manager, Panorama, and CDSS components will land in different places in that model. The exact implementation details vary, but the operating purpose becomes easier to remember.

The June 2026 blueprint also expects you to understand remote-user and hybrid-network connectivity. That requires thinking beyond device configuration. A remote user may need secure access to public and private applications, identity-aware policy, certificates, segmentation, monitoring, and consistent protection. A branch may need SD-WAN path selection as well as security. A hybrid application may span on-premises and cloud environments. The difficulty comes from choosing the correct combination of connectivity and security controls without mixing product responsibilities.

The 30 percent platform domain deserves special attention

Platform Solutions, Services, and Tools carries 30 percent of the blueprint, making it the largest domain. It covers the security efficacy of NGFW and Prisma SASE products, Cloud-Delivered Security Services, AIOps, Next-Generation Trust Security, quantum-security risks, and AI-related security risks. The domain is broad enough that weak preparation here can make the whole exam feel unpredictable.

Do not study CDSS as a flat list. Group each service by the risk it addresses. Advanced WildFire and threat-prevention capabilities relate to malicious content and threat analysis. Advanced URL Filtering and Advanced DNS Security address risky destinations and name-resolution threats. Enterprise DLP focuses on sensitive data movement. SaaS Security focuses on visibility and control of SaaS use. IoT security adds context for unmanaged and specialized devices. Premium GlobalProtect and PAN-OS SD-WAN support different connectivity and user-experience needs.

AIOps should be understood as an operational aid for aligning environments with best practices, surfacing health or configuration concerns, and improving administration. NGTS should be treated as part of a broader trust and identity story. Quantum-security and AI-security objectives should be studied at the level the blueprint asks: identify the risk, describe the mitigation concept, and explain how relevant platform capabilities help discover, monitor, control, or secure the exposure. Do not turn these objectives into a graduate course in cryptography or machine learning.

Configuration depth: what you should and should not memorize

The maintenance and configuration domain is only 10 percent, but configuration knowledge appears indirectly throughout the blueprint. You should be comfortable with the purpose and interaction of policies, profiles, updates, upgrades, monitoring, and logging. You should know how these concepts apply across hardware firewalls, VM-Series, CN-Series, Cloud NGFW, and Prisma Access.

Avoid memorizing long click paths unless a workflow is so fundamental that the interface sequence reinforces the concept. Interfaces change; operational intent is more durable. Instead, know the dependencies. A policy decision requires match criteria. Allowed traffic may then be subjected to security profiles. Decryption affects what inspection can see. Updates influence the ability to identify applications and threats. Logging supports validation and troubleshooting. Central management introduces hierarchy, consistency, and change-control considerations.

When studying upgrades or maintenance, think about risk rather than version trivia. What must remain available? What dependencies could break? How do you preserve policy intent? How do HA, centralized management, backups, and staged change reduce operational risk? Scenario questions become easier when you reason from continuity and control instead of trying to remember a product-specific checklist word for word.

Infrastructure management is a readiness separator

Candidates who have only worked on a single firewall often underestimate the Infrastructure Management and CDSS domain. The exam expects understanding of policies, profiles, updates, IoT security, Enterprise DLP, Enterprise SaaS Security, and supported-product management in Strata Cloud Manager and Panorama. That requires moving from device administration to fleet administration.

At scale, configuration quality is not only about whether a rule works. It is also about consistency, governance, visibility, reporting, onboarding new devices, and preventing drift. A change that is easy on one appliance can become risky across hundreds of enforcement points. Centralized management exists to make those operations more predictable. If you have never managed at scale, simulate the decision process: define global controls, local exceptions, ownership, logging standards, rollout sequencing, and rollback criteria.

Data security adds another dimension. DLP and SaaS security are not merely add-ons to firewall rules. They introduce questions about data classification, encryption, access control, application context, and monitoring. A strong candidate can explain which layer is making the access decision, which layer is protecting data, and which telemetry would prove that the intended control is working.

Connectivity and security: where theory becomes architecture

The Connectivity and Security domain asks candidates to reason about on-premises, cloud, and hybrid environments as well as remote users. The core controls are familiar: segmentation, policy, monitoring, logging, certificates, and remote-access components. What changes is the architecture.

Take a hybrid application. Some services may run in a data center, others in a public cloud, and users may connect from corporate offices or remotely. A useful design conversation asks where trust boundaries exist, how routes are established, where security policy is enforced, how identity follows the user, how certificates establish trust, how logs are correlated, and how private application access differs from public internet access. If you can work through those questions without tying yourself to a single appliance, you are thinking at the right level.

Certificates deserve special attention because they cut across many objectives. They appear in decryption, remote access, device trust, application publishing, and secure management. You do not need to become a public-key-infrastructure architect, but you should understand certificate purpose, trust chains, validity, hostname or identity matching, and the operational impact of an expired, untrusted, or incorrectly deployed certificate.

What makes the exam hard for experienced firewall engineers

Experience can create blind spots. A candidate who has administered Palo Alto Networks firewalls for years may assume the exam will mostly reward PAN-OS depth. The current blueprint is wider. A strong firewall engineer can lose ground on Prisma Access, Prisma SD-WAN, Cloud NGFW, CN-Series, Strata Cloud Manager, CDSS, AIOps, NGTS, DLP, SaaS Security, IoT security, AI risks, and quantum-security concepts.

Another risk is overengineering. Experienced engineers sometimes reject a straightforward exam answer because they can imagine an exception from a complex production environment. Certification questions normally provide a constrained scenario. Use the information given, identify the primary requirement, and choose the option that best satisfies that requirement. Do not invent missing constraints unless the scenario implies them.

Finally, experienced practitioners may rely on muscle memory from one product version or organization. The exam is based on the current blueprint, not on the way one employer happened to configure a firewall three years ago. When your experience conflicts with current documentation, treat the discrepancy as a prompt to update your mental model.

What makes the exam hard for newer security professionals

Newer candidates often have the opposite problem: they can learn the product map quickly but lack the operational context that makes the map meaningful. They may know that a security policy references zones and applications but not recognize how a routing, NAT, certificate, identity, or logging problem can change the observed behavior.

The cure is not to memorize more terms. It is to build small cause-and-effect exercises. Change one variable at a time. What happens if a session is not decrypted? What happens if User-ID is missing? What happens if the application changes after initial classification? What happens if a certificate is not trusted? What happens if a remote user can reach the network but not the private application? What happens if policy allows traffic but no security profile is attached? These questions create operational intuition.

If you are still learning general networking, do not be discouraged, but be realistic about sequence. NetSec-Pro becomes much more manageable after you can explain packets, sessions, zones, routing, NAT, DNS, TLS, identity, and policy without needing to look up every term. Build those foundations first, then layer the Palo Alto Networks portfolio onto them.

A practical readiness matrix

A useful readiness check has four levels. At Level 1, you recognize the term. At Level 2, you can explain what it does. At Level 3, you can choose when to use it in a scenario. At Level 4, you can troubleshoot or compare it when the obvious design does not work. NetSec-Pro readiness usually requires Level 3 across nearly all blueprint objectives, with Level 4 on the technologies closest to your experience.

Apply that scale to every major area. For App-ID, can you explain why application awareness changes policy design? For decryption, can you choose between forward proxy, inbound inspection, SSH proxy, and no decrypt based on traffic and risk? For Prisma Access, can you explain how remote users and remote networks are secured? For Prisma SD-WAN, can you connect path selection and WAN optimization with policy and visibility? For CDSS, can you map a service to the risk it mitigates? For SCM and Panorama, can you explain centralized-management value and operating considerations?

Then test newer blueprint items the same way. Can you explain harvest-now-decrypt-later risk in plain language and why post-quantum readiness matters? Can you identify AI-related risks such as sensitive-data exposure, unsafe application use, or AI-enabled threats and map them to discovery, monitoring, control, and security capabilities? If your answers collapse into buzzwords, the topic is not ready.

Readiness signal 1: you can explain tradeoffs, not just definitions

One of the strongest signs of readiness is the ability to explain why one design is preferable to another under stated conditions. For example, you should be able to compare local and centralized management, physical and cloud-delivered enforcement, broad IP-based policy and identity-aware policy, encrypted and decrypted inspection, or direct internet access and secured SASE access without declaring one option universally superior.

Tradeoff reasoning includes operational cost. A technically correct control that is impossible to maintain is not a good enterprise design. Consider policy sprawl, certificate lifecycle, upgrade coordination, branch consistency, logging volume, troubleshooting visibility, user experience, and exception handling. The exam may not ask for a complete total-cost model, but understanding operations helps distinguish plausible answers.

A simple exercise is to write a two-column comparison for every pair of technologies you confuse. In one column, write the condition that favors option A. In the other, write the condition that favors option B. If both columns contain only feature names, you are still memorizing. If they contain business and technical conditions, you are reasoning.

Readiness signal 2: you can troubleshoot by layer

Troubleshooting is not a separate blueprint domain, but it is a powerful readiness indicator because it exposes whether your knowledge is connected. A candidate who can troubleshoot by layer understands dependencies. Start with connectivity, then session establishment, routing and NAT, policy match, identity and device context, decryption, security profiles, application behavior, and logging.

Imagine a remote user reports that a private application is unreachable. A weak approach jumps directly to changing a rule. A stronger approach asks whether the user is authenticated, whether the remote-access path is established, whether name resolution is correct, whether routes exist, whether the destination is reachable, whether policy matches, whether certificates are trusted, and what the logs show. The sequence prevents random configuration changes.

You can apply the same method to branch performance, SaaS access, DLP events, DNS-security blocks, and application identification. If your troubleshooting process consistently asks what evidence would confirm or eliminate a layer, you are developing the operational judgment expected of a professional-level certification.

Readiness signal 3: you can move between products without losing the security objective

NetSec-Pro becomes much easier when product names stop controlling your thought process. The security objective should come first. If the goal is to reduce malicious web access, think about application control, URL controls, DNS protection, decryption, threat prevention, identity, and logging. If the goal is to protect sensitive data in SaaS applications, think about data classification, DLP, SaaS visibility, access control, and monitoring. Then map those needs to the appropriate platform capabilities.

This is also the point at which it becomes useful to compare adjacent certification paths. If you are trying to decide whether you need broad platform knowledge or a more specialized product role, the Palo Alto Networks certification catalog gives you a practical way to compare the current exam families before investing time in the wrong depth. The value of that comparison is not the link itself; it is the discipline of matching your role and learning goal to the scope of the credential.

If you can describe the same security outcome across an appliance, a cloud enforcement point, and a SASE design without confusing the roles of routing, management, policy, identity, and inspection, your platform understanding is becoming exam-ready.

Readiness signal 4: your practice results are diagnostically stable

Practice questions are useful only when they reveal repeatable reasoning. A single high score can be misleading if it comes from recognizing previously seen wording. A better signal is stability across mixed topics, new scenarios, and different study sessions. Track why you missed each question: concept gap, product-role confusion, reading error, overthinking, weak networking foundation, or lack of operational context.

When you use NetSec-Pro practice questions, treat them as a readiness diagnostic rather than a memorization source. For every miss, explain why the correct option satisfies the scenario, why the strongest distractor does not, and which blueprint objective the decision belongs to. If you cannot reconstruct the reasoning without looking at the answer, the topic is not yet learned.

A strong readiness pattern is that your misses become narrow and explainable. Early in preparation, you may have broad gaps across SASE, CDSS, and centralized management. Later, you should see isolated errors such as confusing two decryption use cases or forgetting which service best addresses a specific data-protection requirement. Narrow misses are easier to correct and suggest that the underlying model is coherent.

Readiness signal 5: you can work under the 90-minute constraint

Time pressure amplifies uncertainty. The current exam duration is 90 minutes, so you need a decision process that is both accurate and efficient. Because the datasheet does not publish a fixed question count in the blueprint itself, do not build a timing strategy around an assumed number of items. Build it around behavior.

On a first pass, identify the requirement before reading every answer as if all options were equal. Look for the key noun and verb: secure remote users, manage many devices, protect SaaS data, inspect encrypted traffic, segment applications, maintain connectivity, or improve security posture. Then eliminate options that solve a different problem. If two choices remain plausible, compare them against the exact scope and constraints in the stem.

Do not let one obscure item consume the time needed for several answerable ones. Mark uncertainty mentally or through the test interface if review is available, choose the best supported answer, and continue. The goal is not to feel certain about every question. It is to preserve enough time to apply sound reasoning across the whole exam.

How to tell that you are not ready yet

Several warning signs are more reliable than nervousness. The first is product-name familiarity without role clarity. If you can recognize Prisma Access, Prisma SD-WAN, Strata Cloud Manager, Panorama, Cloud NGFW, and CDSS but cannot explain what problem each solves, keep studying. The second is firewall-only confidence. If your preparation repeatedly returns to PAN-OS because that is comfortable, you are leaving major blueprint areas exposed.

A third warning sign is dependence on exact wording. If a concept makes sense only when it appears in the same sentence used by a study source, you have memorized language rather than learned the model. Rephrase the concept, draw it, explain it to a colleague, or apply it to a new scenario. A fourth warning sign is unstable practice performance, especially when scores drop sharply on mixed-domain questions.

Finally, be cautious if troubleshooting still means trying changes until something works. Professional-level readiness means you can predict what evidence a change should produce and why. If you cannot say what log, session state, identity mapping, route, certificate, or policy match would confirm your hypothesis, your practical foundation needs more work.

A final decision framework: schedule, delay, or rebuild

Schedule the exam when you can explain nearly every blueprint objective in your own words, apply most of them to short scenarios, and move between NGFW, SASE, CDSS, management, and connectivity topics without losing the underlying security objective. You should also be able to complete mixed practice under time pressure with consistent reasoning and a clear error log.

Delay the exam briefly when the foundation is sound but one or two domains remain weak. For example, a firewall engineer who is comfortable with fundamentals, maintenance, management, and connectivity but weak on Prisma SASE and CDSS may need a focused review rather than a complete restart. Use the domain weights to prioritize, but do not ignore a weak domain merely because its percentage is smaller.

Rebuild the foundation when basic networking, policy, identity, decryption, certificates, or traffic-flow reasoning is still uncertain. In that situation, more exam questions usually produce frustration rather than learning. Return to small labs and architecture exercises until you can predict what the platform should do and verify that prediction with evidence.

How difficult is NetSec-Pro in practical terms?

For an experienced network-security professional who understands Palo Alto Networks firewalls and has at least working familiarity with Prisma Access, Prisma SD-WAN, centralized management, and CDSS, NetSec-Pro is a demanding but manageable breadth exam. The main work is filling product-family gaps, updating knowledge to the current June 2026 blueprint, and practicing cross-platform scenario reasoning.

For a firewall-only administrator, difficulty is moderate to high because the exam extends well beyond the appliance. The fastest path is not to study every product at the same depth. Learn what each product is for, how it is managed, what security problem it solves, what telemetry it produces, and how it connects to the rest of the platform.

For someone new to network security, difficulty is high because the exam assumes enough networking and security understanding to make platform decisions meaningful. The correct response is not to avoid the certification indefinitely. It is to build the prerequisite skills deliberately: traffic flow, segmentation, policy, NAT, identity, TLS, certificates, logging, remote access, and basic enterprise architecture.

The most reliable readiness signal is not confidence. It is transfer. If you can take a security requirement you have not seen before, map it to the relevant Palo Alto Networks capabilities, explain the tradeoffs, and identify the evidence you would use to validate the design, you are operating at the level the certification is trying to measure.