FCP study plan
FCP · Give each week a clear focus.
8 weeks · About 7 hours per week
Security Fabric and Network Security Fundamentals
Diagram the Security Fabric components from memory: FortiGate, FortiAnalyzer, FortiManager, FortiSwitch, FortiAP, and how fabric telemetry flows between them
Configure a lab FortiGate with at least two interfaces, a default route, and administrative access restricted to a trusted subnet
Explain the difference between a fabric root and downstream devices and when each is used
Identify the default ports and protocols used for fabric synchronization and logging
Your checkpoint
A one-page hand-drawn Security Fabric topology with every device role and connection labeled, plus a working lab FortiGate reachable over HTTPS from the management subnet
Firewall Policies and Traffic Shaping
Build firewall policies covering intrazone, interzone, and policy ordering with implicit deny verification
Configure NAT: source NAT with a pool and destination NAT (VIP) for an internal web server
Create traffic shaping policies with shared and per-IP shapers and verify behavior with a bandwidth test
Write a policy audit checklist and apply it to your lab ruleset to remove shadowed or overly permissive rules
Your checkpoint
A documented policy table (source, destination, service, action, NAT, shaper) for at least 8 policies that passes a peer-style review against your audit checklist
Authentication and Access Control
Configure local user accounts, groups, and password policy, then test lockout behavior
Integrate an LDAP or RADIUS server for administrator and firewall-user authentication
Set up two-factor authentication for a test admin account and confirm the login flow end to end
Map authentication rules to policy so that user identity drives access rather than IP alone
Your checkpoint
A working authentication chain (directory server plus 2FA) with screenshots or config export showing a successful authenticated login and a denied login
SSL VPN and IPsec VPN Configuration
Configure a full-tunnel SSL VPN with a portal, firewall policy, and split-tunnel variant, then connect a client to each
Build a route-based IPsec tunnel between two lab FortiGates and verify Phase 1 and Phase 2 negotiation
Compare SSL VPN and IPsec tradeoffs for remote access versus site-to-site and justify a design choice
Troubleshoot one deliberately broken tunnel using debug output
Your checkpoint
A working SSL VPN connection and a working site-to-site IPsec tunnel, with a short write-up of the debug commands used to bring up the broken tunnel
Web Filtering and Application Control & Intrusion Prevention and Anti-Malware
Configure web filtering with a custom category and a URL filter, then confirm allow and block outcomes
Apply an application control profile that blocks at least one application signature and logs it
Enable an IPS sensor with a targeted signature set and generate a test alert using a safe test target
Configure anti-malware and antivirus scanning on a traffic profile and verify logging of a test file
Explain how web filter, app control, IPS, and anti-malware profiles stack inside a single firewall policy
Your checkpoint
One firewall policy with all four security profiles attached, plus a log excerpt showing each profile producing at least one event
Routing and SD-WAN
Configure static routes and at least one dynamic routing protocol (OSPF) between lab devices
Build an SD-WAN zone with two WAN members and a health check SLA target
Create an SD-WAN rule that steers traffic by link quality and verify failover by disabling one member
Read the routing table and SD-WAN monitor output to confirm the active path
Your checkpoint
A demo where traffic fails over from the primary to the secondary WAN link within a defined SLA threshold, evidenced by SD-WAN monitor output
Logging, Monitoring, and Troubleshooting & High Availability and System Maintenance
Configure local and remote logging and query logs by policy, user, and threat type
Set up an HA pair (active-passive) in the lab and verify session failover
Perform a configuration backup and a restore, and document the firmware upgrade path
Use packet capture and debug flow to trace a single dropped connection to its cause
Review HA heartbeat and synchronization status to confirm the pair is healthy
Your checkpoint
A troubleshooting runbook entry that traces one blocked connection from log to packet capture to root cause, plus a verified HA failover result
Security Fabric and Network Security Fundamentals & Firewall Policies and Traffic Shaping & Authentication and Access Control & SSL VPN and IPsec VPN Configuration & Web Filtering and Application Control & Intrusion Prevention and Anti-Malware & Routing and SD-WAN & Logging, Monitoring, and Troubleshooting & High Availability and System Maintenance
Re-take timed practice sets weighted by domain percentage and log every missed question by domain
Re-drill the two weakest domains from your miss log until accuracy is above 80 percent
Recite the Security Fabric, policy, and VPN design tradeoffs aloud without notes
Run a full timed mock exam under exam conditions
Your checkpoint
A domain-by-domain accuracy scorecard from the mock exam showing at least 80 percent in every domain, with a remediation note for any domain still below threshold
Milestones
Week 2: Can build a NAT-and-shaper policy set from a blank config without notes, and explain policy order and implicit deny to someone else
Week 4: Both VPN types are up and passing traffic; you can describe Phase 1 versus Phase 2 failure symptoms
Week 6: SD-WAN failover works and you can read routing and SD-WAN monitor output to prove the active path
Week 8: Mock exam shows at least 80 percent accuracy in every domain, with the two weakest domains re-drilled and documented