I85PREP
⌘ K
Fortinet FCA study materials
Fortinet FCA study resources

Fortinet FCA: Cloud, SASE, and Zero Trust Fundamentals

Fortinet FCA · Work through your exam, one topic at a time.

All guide sections

Cloud, SASE, and Zero Trust Fundamentals

What this domain tests

Cloud, SASE, and Zero Trust Fundamentals tests how Fortinet extends security beyond the campus: cloud-delivered SASE, zero trust access to applications, and cloud workload protection. Expect definitions, architecture, and the difference between network-level VPN and application-level ZTNA.

Core rules and concepts

  • SASE converges WAN edge networking with cloud-delivered security. Core components include SD-WAN, secure web gateway, cloud access security broker, firewall as a service, and ZTNA.
  • FortiSASE is Fortinet's cloud-delivered SASE offering. It applies FortiGuard-powered security and FortiOS policy to users and branches without backhauling all traffic to a data center.
  • Zero trust means verify explicitly, grant least privilege, and assume breach. Access is granted per application and per session based on identity, device posture, and context, not because a user is on the corporate network.
  • ZTNA provides application-level access. FortiClient can act as the ZTNA client, FortiGate can enforce ZTNA policies, and FortiAuthenticator can provide identity and MFA.
  • Cloud security is shared responsibility. Fortinet products such as FortiGate VM, FortiCNAPP, FortiCASB, and FortiWeb Cloud protect workloads, cloud posture, SaaS use, and web applications.

Worked example

A contractor needs access to one internal HR application but must not reach the whole corporate LAN. Use a ZTNA rule on the FortiGate, require FortiClient on the device, authenticate the contractor through FortiAuthenticator with MFA, and check device posture. Allow only the HR application and log the session. A full-tunnel SSL VPN would grant broader network reach and violates least privilege. The reasoning is: identity and posture decide access; the application, not the network, is the access boundary.

Traps that cost marks

  • Calling SASE just another VPN; SASE is a converged networking and security architecture.
  • Treating zero trust as one-time authentication; it is continuous, context-aware authorization.
  • Assuming the cloud provider secures everything under shared responsibility.
  • Confusing FortiSASE with FortiGate Cloud, which is a management and service portal for FortiGate.
  • Using SSL VPN where ZTNA is required for least-privilege application access.