Pix isnt covered on the CCNA at all. Its part of the CCSP or CCIE tracks. For the CCSP you used to have to do 5 modules, securing CISCO IOS (access lists, authentication etc for use with cisco switches and routers running IOS), CSPFA (cisco secure pix firewall advanced), VPN concentrators, CISCO IDS, and SAFE (Ciscos own ideas on how to build a secure network). I know that some of the course titles including the PIX one have recently changed, but the structure is still the same. As said above you have to pass the CCNA inorder to get a PIX certification but its not a prerequestite for the PIX course. If you want a PIX certification but dont want to do VPN, IDS etc you can do the CFS (Cisco Firewall Specialist) for which you have to pass the CCNA, PIX exam and the securing cisco IOS exam.