FCP FortiAuthenticator 6.5 study plan

Map the FortiAuthenticator role in an identity architecture: distinguish it from FortiGate local users, LDAP/AD servers, and RADIUS clients, and state where each fits

Draw the authentication request flow for a RADIUS-authenticated VPN user from client to identity store, labeling every hop and protocol

Enumerate the built-in user types (local, remote LDAP, RADIUS, SAML, TACACS+, PKI) and record which credential store each one uses

Install a FortiAuthenticator VM in a lab and complete initial setup: admin account, network interfaces, DNS, NTP, and license activation

Configure a remote LDAP/Active Directory connection and verify bind, base DN, and attribute mapping with a successful test lookup

Create local user groups, remote groups, and group-mapping rules, then explain how group membership drives authorization decisions

Configure RADIUS clients and a RADIUS policy so a FortiGate can authenticate against FortiAuthenticator

Test authentication with at least three user sources and capture the debug output for each attempt

Configure two-factor authentication with FortiToken, including token assignment, activation, and a successful push or OTP login

Set up email and SMS one-time-passcode delivery and document the SMTP and SMS gateway settings required

Implement a RADIUS policy that enforces 2FA only for a named group while leaving another group single-factor

Explain the difference between authentication and authorization in FortiAuthenticator and identify which objects control each

Deploy certificate-based authentication: generate a CSR, import a CA-signed certificate, and configure a PKI user for client-certificate login

Configure OCSP or CRL checking and demonstrate revocation behavior when a certificate is revoked

Build a FortiGate-to-FortiAuthenticator integration for administrative or SSL-VPN login and verify group-based access

Review authentication logs and identify the exact log entry that records a failed versus successful attempt

Configure FortiAuthenticator as a SAML identity provider and register a relying party (such as FortiGate or FortiMail) with correct assertion attributes

Configure FortiAuthenticator as a SAML service provider against an external IdP and map the returned attributes to user groups

Explain the difference between IdP-initiated and SP-initiated flows and demonstrate at least one of each

Set up a portal-based SSO experience and document what the user sees at each step

Troubleshoot a deliberately broken SAML configuration by reading the debug logs and correcting the attribute or certificate mismatch

Configure log forwarding to a syslog or FortiAnalyzer destination and confirm events arrive

Set up and interpret the dashboard widgets that show authentication success and failure rates

Configure an alert or event handler that triggers on repeated authentication failures

Perform a backup and restore of the FortiAuthenticator configuration and verify settings survive the round trip

Plan and execute a firmware upgrade path in the lab, including pre-upgrade backup and post-upgrade validation checks

Configure HA between two FortiAuthenticator nodes and describe the failover behavior for RADIUS and SAML traffic

Review and tune account lockout, password policy, and session timeout settings against a stated security requirement

Re-take a full-length practice assessment and score each domain separately to find remaining weak spots

Revisit the three lowest-scoring objectives and rebuild each one hands-on in the lab

Summarize the key configuration objects and their relationships on a single reference sheet

Time-box a review of 2FA, SAML, and HA, the areas most likely to combine into scenario questions