Fortinet FCA study plan
Fortinet FCA · Give each week a clear focus.
8 weeks · About 6 hours per week
Fortinet Platform and Product Portfolio Fundamentals
Map each major Fortinet product family (FortiGate, FortiManager, FortiAnalyzer, FortiSwitch, FortiAP, FortiWeb, FortiMail, FortiClient, FortiSandbox, FortiSIEM, FortiSASE) to the security problem it solves and the deployment location it occupies
Distinguish FortiOS as the shared operating system from the hardware and virtual appliance models that run it, and explain how FortiGuard subscription services attach to products
Describe the Fortinet Security Fabric architecture: the Fabric root, Fabric connectors, and how telemetry flows to FortiAnalyzer and FortiManager
Explain the difference between FortiGate NGFW, FortiGate next-generation firewall with SD-WAN, and the SASE/cloud-delivered offerings in portfolio terms
Your checkpoint
A one-page product-to-problem matrix covering at least 10 Fortinet products with deployment location and the single strongest exam-relevant differentiator for each
Fortinet Platform and Product Portfolio Fundamentals & Network Security Fundamentals (FortiGate, FortiOS, NGFW)
Identify the functional zones of FortiOS: firewall policy, routing, UTM profiles, VPN, and administrative access, and state what each controls
Trace the packet path through a FortiGate from ingress interface through policy lookup, security profile inspection, and egress, including where NP and CP acceleration apply
Configure and explain the difference between firewall addresses, addrgrp, services, and schedules as policy building blocks
Explain how VDOMs partition a FortiGate and when an administrator would choose multi-VDOM mode
Your checkpoint
A hand-drawn or text-based diagram of the FortiGate packet flow with every inspection stage labeled, plus a written explanation of one policy that permits HTTP but blocks a specific application signature
Network Security Fundamentals (FortiGate, FortiOS, NGFW)
Differentiate stateful packet inspection, application control, IPS, antivirus, web filtering, and DNS filtering by what each inspects and what it cannot see
Explain how security profiles are applied in a firewall policy, including the difference between flow-based and proxy-based inspection modes and the trade-offs of each
Describe SSL/TLS deep inspection: certificate handling, exemptions, and the operational risks an administrator must plan for
Compare NAT modes on FortiGate (source NAT with IP pools, destination NAT with VIPs, central NAT) and predict which mode a given scenario requires
Your checkpoint
A written scenario analysis of three traffic types (encrypted SaaS, internal east-west, inbound web service) stating the correct profiles, inspection mode, and NAT configuration for each
Network Security Fundamentals (FortiGate, FortiOS, NGFW) & Security Operations and FortiGuard Services Fundamentals
Explain how FortiGuard Labs distributes threat intelligence and how FortiGate consumes it through subscription services such as IPS signatures, antivirus definitions, web filter categories, and outbreak alerts
Distinguish the FortiGuard service categories (security services, infrastructure services such as DDNS and FortiManager Cloud, and support services) and state which are license-gated
Describe the role of FortiAnalyzer for log collection, correlation, and reporting versus FortiManager for centralized policy and device management
Explain FortiSandbox integration and the concept of a verdict feeding back into the FortiGate to block previously unknown files
Your checkpoint
A comparison table of at least six FortiGuard services listing what each protects, where it is enforced, and what breaks operationally when the license lapses
Security Operations and FortiGuard Services Fundamentals
Interpret FortiGate log fields and event types (traffic, UTM, event, anomaly) and identify which log type answers a given investigative question
Describe the incident response lifecycle in a Fortinet context: detection via FortiAnalyzer or FortiSIEM, triage, containment using policy or quarantine, and post-incident reporting
Explain how automation stitches and Fabric connectors reduce mean time to respond, and give one concrete example of a triggered playbook
Summarize the security operations value of centralized visibility: why logs on the FortiGate alone are insufficient for an audit trail
Your checkpoint
A mock incident write-up for a malware download attempt, including the log types and fields you would query, the containment action, and the report section you would deliver to management
Cloud, SASE, and Zero Trust Fundamentals
Define Zero Trust principles (explicit verification, least privilege, assume breach) and map each to a concrete Fortinet capability such as ZTNA, FortiClient EMS, or microsegmentation
Explain how FortiSASE and cloud-delivered security differ from on-premises FortiGate enforcement, including the role of points of presence and the thin edge
Describe secure SD-WAN in FortiOS and how it relates to SASE: application steering, SLA probes, and where security inspection happens
Explain identity-aware access in Fortinet terms: how user identity from LDAP, RADIUS, or SAML is attached to a session and used in policy
Your checkpoint
A one-page Zero Trust architecture sketch showing an off-network user, the enforcement point, the identity source, and the policy decision, with each arrow annotated by the Fortinet product that provides it
Cloud, SASE, and Zero Trust Fundamentals & Fortinet Platform and Product Portfolio Fundamentals
Compare the cloud deployment forms of FortiOS (FortiGate-VM in public clouds, FortiCNP, FortiCNAPP-style posture tooling) and state which exam-relevant problem each addresses
Explain the shared responsibility model as it applies to a FortiGate-VM deployed in a public cloud and where Fortinet's obligations end
Describe how the Security Fabric extends across on-premises, branch, and cloud estates and what role FortiManager and FortiAnalyzer play in that extension
Identify common misconfigurations in SASE and ZTNA adoption, such as over-broad access policies or missing device posture checks
Your checkpoint
A written answer to the question 'How does a Fortinet deployment enforce the same policy for a user at headquarters, at a branch, and working from home?' with the products and enforcement points named for each case
Fortinet Platform and Product Portfolio Fundamentals & Network Security Fundamentals (FortiGate, FortiOS, NGFW) & Security Operations and FortiGuard Services Fundamentals & Cloud, SASE, and Zero Trust Fundamentals
Reconstruct from memory the four domain weightings and the three highest-yield concepts in each domain
Resolve every concept you flagged as uncertain in weeks 1 through 7, writing a corrected one-sentence explanation for each
Practice explaining aloud, in under two minutes each, the Security Fabric, the FortiGate packet flow, FortiGuard service delivery, and Zero Trust with ZTNA
Identify the weakest domain by self-assessment and complete one focused review pass on it only
Your checkpoint
A personal one-page cheat sheet organized by the four domains, containing only facts you can state without notes, plus a short list of the remaining gaps you will review the morning of the exam
Milestones
Week 2: Without notes, list at least 10 Fortinet products with the problem each solves and draw the FortiGate packet flow with inspection stages in the correct order
Week 4: Explain the difference between flow-based and proxy-based inspection, name three FortiGuard security services, and state what stops working when a subscription expires
Week 6: Describe Zero Trust in your own words and map three Zero Trust principles to specific Fortinet capabilities, including at least one SASE or ZTNA component
Week 8: State all four domain weightings from memory, score at least 80 percent on a self-made 40-question recall set spanning all domains, and have a written list of no more than five remaining weak areas