FCSS Public Cloud Security study guide
FCSS Public Cloud Security · Work through your exam, one topic at a time.
The FCSS Public Cloud Security credential is listed on our exam catalogue as a Fortinet Certified Solution Specialist certification focused on public cloud security, with the alias "FCSS in Public Cloud Security". It is aimed at security engineers, cloud architects, and network security professionals who design, deploy, and operate Fortinet security controls across public cloud environments such as AWS, Microsoft Azure, Google Cloud, and Oracle Cloud. The FCSS Public Cloud Security study guide has 5 sections and about 1,949 words.
01Public Cloud Security Fundamentals and Shared Responsibility
The first domain tests whether you can place each control on the correct side of the cloud shared-responsibility line and choose the right Fortinet control for the customer's side. Expect service-model comparisons (IaaS, PaaS, SaaS), provider responsibility matrices, and scenarios where a control is technically available but ownership still sits with the customer.
420 words, about 2 min02Cloud Network Security Architecture (VPC/VNet, Segmentation, Routing)
The second domain tests design decisions: address plans, subnet tiers, route tables, stateful versus stateless filters, and how a FortiGate is inserted without breaking return paths. Questions often use AWS VPC, Azure VNet, or GCP VPC terminology interchangeably but expect cloud-specific route behavior.
381 words, about 2 min03Deploying and Managing FortiGate Virtual Appliances in Public Clouds
Domain three covers lifecycle: choosing a licensing model, sizing and placing FortiGate-VM instances, bootstrapping configuration, and managing HA or autoscaling through cloud APIs and FortiManager. FortiGate-VM is available as BYOL and as pay-as-you-go marketplace images; FortiFlex tokens are another licensing route.
394 words, about 2 min04Cloud-Native Protection and Posture Management (CNAPP)
Domain four tests CNAPP: cloud security posture management (CSPM), cloud workload protection (CWPP), cloud infrastructure entitlement management (CIEM), infrastructure-as-code scanning, vulnerability and image scanning, and attack-path prioritization. The exam expects you to know what each capability can and cannot do.
366 words, about 2 min05Cloud Traffic Inspection, Automation, and Operations
Domain five tests operations: how traffic reaches a FortiGate for inspection, how to automate deployment and response, and how to observe the result. Expect inline and out-of-band designs, TLS inspection, logging pipelines, and API-driven workflows.
388 words, about 2 min