FCSS FortiSASE 25 Administrator study plan

Map the FortiSASE administrative hierarchy (account, organization, tenant, and per-region deployment) and diagram how a tenant relates to FortiCloud identity and licensing

Walk through the deployment wizard end to end in a lab tenant and record every prerequisite it demands before the tenant becomes usable

Configure at least two administrator accounts with distinct role-based profiles and verify which UI areas each profile can reach

Explain in writing how the point-of-presence (POP) selection model affects user latency, and identify the settings that constrain or override automatic POP selection

Configure a FortiGate as a secure private access (SPA) edge and register it to the FortiSASE tenant, capturing the trust and certificate steps required

Define internal subnets and destinations that should be reachable through the private access path, and verify traffic actually traverses the tunnel instead of the public internet

Distinguish the deployment modes available for private access (for example agent-based versus tunnel-based) and select the correct one for a stated branch scenario

Document the outbound ports and connectivity requirements that must be allowed on the on-premises firewall for the tunnel to establish

Configure SD-WAN on the FortiGate side so that private access traffic prefers a healthy WAN link and fails over when that link degrades

Build at least two SD-WAN health-check targets and interpret the resulting SLA log entries when a link is artificially degraded

Describe how FortiSASE handles traffic steering for private versus internet-bound traffic and where the decision is enforced

Troubleshoot a deliberately broken tunnel by checking certificates, routing, and policy order in sequence

Configure a web filter profile with category-based blocking, URL override entries, and safe-search enforcement, then verify each behavior with test requests

Explain the difference between allow, block, monitor, and warning actions and predict which page a user sees for each

Set up HTTPS inspection exclusions for categories that must not be decrypted and justify each exclusion

Compare the available content-filtering enforcement points and state which one applies to roaming users versus on-premises users

Configure SSL inspection with a custom certificate and a deep-inspection exemption list, then prove that an exempted site is not decrypted

Enable DNS filtering and demonstrate blocking of a known-malicious test domain at the DNS layer rather than the HTTP layer

Tune antivirus and IPS profiles so that a benign test file and a known test signature produce the expected log entries without excessive false positives

Apply an application control profile that blocks a specific application category while permitting a business-critical application in the same category

Deploy the FortiSASE client to a test endpoint and enroll it into the tenant, confirming that the endpoint appears in the management view

Configure ZTNA access rules that grant one user group access to one internal application and deny a second group, then verify both outcomes

Explain how endpoint posture (for example OS version or antivirus state) can gate access and configure one posture check

Distinguish FortiClient EMS management from FortiSASE client management and state which tasks belong to each

Navigate the logging views to isolate traffic for a single user across web filter, IPS, and private access logs

Configure log forwarding or a syslog destination and confirm events arrive at the collector

Use the built-in diagnostic and troubleshooting views to identify why a user session was blocked

Build a short triage checklist that orders investigation steps from client status to policy evaluation to log confirmation

Re-run every lab from weeks 1 through 7 in a fresh tenant without consulting notes, noting every step that required recall

Review the weakest two domains identified during the re-run and close the specific gaps with targeted reading

Practice explaining the private access and SD-WAN architecture aloud in under five minutes, as if to a colleague

Confirm familiarity with the administrative tasks most likely to appear in scenario form, such as POP selection, inspection exemptions, and ZTNA rule ordering