Fortinet FCF study plan

Map the OSI and TCP/IP models layer by layer and write, from memory, which security control operates at each layer

Explain the difference between stateful inspection, packet filtering, and application-layer inspection using one concrete traffic example for each

Define core cryptographic primitives (symmetric vs asymmetric encryption, hashing, digital signatures, PKI) and state one security property each provides

Diagram a typical enterprise perimeter (WAN edge, firewall, DMZ, internal segmentation) and label where each control sits

Compare the main firewall deployment modes (routed/NAT, transparent, virtual, hybrid) and list one scenario where each is appropriate

Describe how NAT, routing, and policy order interact when a packet traverses a firewall, tracing a sample packet end to end

Explain VPN fundamentals (site-to-site vs remote-access, IPsec phases, SSL/TLS VPN) and identify what each protects

Distinguish authentication, authorization, and accounting and give one enterprise example of each

Summarize common network attacks (spoofing, ARP poisoning, DoS, man-in-the-middle) and one mitigation for each

Define the SOC roles and workflow from alert ingestion through triage, escalation, and closure

Explain the purpose of SIEM, SOAR, EDR, and log management, and state how they differ

Walk through the incident response lifecycle (preparation, detection, containment, eradication, recovery, lessons learned) and assign an action to each phase

Interpret a sample log or alert and classify its severity with a written justification

Describe common monitoring and detection data sources (firewall logs, flow data, endpoint telemetry, DNS logs) and what each reveals

Explain threat intelligence concepts (IOCs, TTPs, the MITRE ATT&CK framework) and map two techniques to detection ideas

Outline vulnerability management and patch prioritization using severity and exposure

Contrast preventive, detective, and corrective controls with one example of each in a SOC context

Define the shared responsibility model and state which controls the provider versus the customer own for IaaS, PaaS, and SaaS

Explain cloud deployment and service models and identify the security implications of each

Describe identity and access management in the cloud, including least privilege, roles, and federation

Summarize cloud network security constructs (virtual networks, security groups, segmentation) and how they differ from on-premises firewalls

Explain data protection in the cloud: encryption at rest and in transit, key management, and data classification

Describe cloud logging, monitoring, and posture management and how misconfiguration becomes a top cloud risk

Define core cybersecurity concepts: the CIA triad, risk (threat x vulnerability x impact), and defense in depth

Summarize common cloud threats (misconfigured storage, credential compromise, insecure APIs) and one mitigation for each

Explain identity and access management broadly: MFA, privileged access, zero trust principles, and least privilege

Describe endpoint and email security controls and the threats they address (malware, ransomware, phishing)

Outline security governance topics: policies, standards, compliance frameworks, and awareness training

Explain cryptography in practice: TLS, certificates, and common misuses

Summarize social engineering tactics and how user awareness reduces risk

Review all four domains using your own notes and close gaps flagged by earlier self-quizzes

Complete two timed 40-question mixed-domain practice sets and score each

For every missed question, write the correct concept and the reason for the error

Re-explain each domain's core ideas aloud in under five minutes per domain