I85PREP
⌘ K
Fortinet FCF study materials
Fortinet FCF study resources

Fortinet FCF: Cloud Security Fundamentals

Fortinet FCF · Work through your exam, one topic at a time.

All guide sections

Cloud Security Fundamentals

Cloud Security Fundamentals tests whether you can apply the shared responsibility model correctly, name the cloud service and deployment models, and match cloud-native risks to the right control category. Expect scenario questions where you must decide whether the provider or the customer owns a given failure.

Shared responsibility

  • The provider secures facilities, hardware, the hypervisor and service availability.
  • The customer secures data classification, identity and access, configuration, encryption keys and user behavior.
  • In IaaS the customer also patches guest operating systems and configures virtual network security; in PaaS the platform handles the runtime; in SaaS the customer mainly controls identities, data sharing and configuration.

The line shifts with the model, but responsibility for the data never transfers to the provider.

Service and deployment models

IaaS, PaaS and SaaS describe what is consumed. Private, public, hybrid, multi-cloud and community describe where it runs. Multi-cloud increases flexibility and also multiplies the identity, logging and policy surfaces you must unify.

Cloud-native risks

Misconfiguration is the dominant cause of cloud incidents: publicly readable storage, security groups open to the internet, disabled logging. Others include over-privileged IAM roles, exposed APIs, shadow IT SaaS, container images with vulnerable dependencies, and limited east-west visibility inside virtual networks.

Controls to know

  • CASB discovers sanctioned and unsanctioned SaaS usage; API-based mode inspects out-of-band, inline proxy mode enforces in the traffic path.
  • CSPM continuously assesses configuration against benchmarks such as CIS and flags drift.
  • CWPP/CNAPP protect workloads, images and containers, and increasingly span code-to-cloud posture. FortiCNAPP is Fortinet's offering in this space.
  • SASE converges networking and security as a service, combining secure web gateway, CASB, firewall-as-a-service and ZTNA; FortiSASE is the Fortinet platform.
  • FortiGate-VM runs in AWS, Azure and GCP to segment virtual networks and apply the same policy model as on-premises.

Worked example

CSPM flags an object-storage bucket holding backups as publicly readable. Because storage configuration belongs to the customer, remediation is entirely customer-side: enable block-public-access, tighten the bucket policy, enable access logging and versioning, and rotate any keys that may have leaked through exposed objects. Escalating to the provider accomplishes nothing.

Traps that cost marks

  • Assuming the provider secures customer data and configuration.
  • Confusing CASB (SaaS usage and data control) with CSPM (configuration posture).
  • Thinking ZTNA or SASE applies only to on-premises users.
  • Forgetting that a VM firewall still depends on cloud security-group rules permitting traffic to reach it.
  • Ignoring that logging and identity are customer responsibilities in every model.