FCSS Public Cloud Security study plan

Map each of the four cloud providers' shared responsibility boundaries by writing out, for IaaS, PaaS, and SaaS, who owns compute, network, identity, and data

Distinguish the security responsibilities Fortinet handles versus what the customer configures when running a FortiGate VM in a public cloud

Identify the licensing models (BYOL, on-demand/pay-as-you-go, and FortiFlex-style consumption) and when each applies

List the supported FortiGate VM instance families and the throughput/interface limits that constrain sizing decisions

Describe how cloud identity (IAM roles, service principals, instance identities) replaces or supplements traditional network trust

Explain the default VPC/VNet behavior and why default networks are a posture risk

Compare security groups/NACLs/NSGs and network security groups' stateful versus stateless behavior

Diagram a baseline two-tier VPC with public and private subnets and explicit egress paths

Design a hub-and-spoke topology using transit gateway/peering constructs and document route propagation

Configure and validate VPC/VNet peering including non-overlapping CIDR planning and transitive routing limits

Implement private connectivity to on-premises (IPsec VPN or dedicated interconnect) and verify failover behavior

Enforce east-west segmentation with security groups and, where needed, a firewall appliance in the traffic path

Deploy a FortiGate VM from the marketplace in at least two providers and register it to a management plane

Configure the minimum viable policy set: interfaces, static routes, NAT/SNAT, and a default-deny policy with logging

Automate bootstrap configuration using user-data/cloud-init or an equivalent metadata mechanism

Validate HA or scale-out options available per provider (active-passive, autoscale, or load-balanced cluster)

Insert the FortiGate VM into the traffic path using gateway load balancer, user-defined routes, or traffic mirroring as the provider allows

Inspect east-west traffic between subnets and confirm policy enforcement with log evidence

Configure logging and forwarding to a central destination and verify records arrive

Document the failure modes when the inspection appliance is unavailable and the designed bypass or fail-closed behavior

Inventory the native posture tools per provider (security hubs, config rules, defender-style services) and what each actually evaluates

Evaluate CSPM findings against a benchmark baseline and triage the top misconfigurations by risk

Describe CWPP concepts: workload agents versus agentless scanning, and image/container scanning in CI

Explain CIEM and how over-permissive identities are detected and remediated

Write infrastructure-as-code that deploys a compliant baseline network and tags resources for policy scoping

Integrate a policy-as-code check into a pipeline so non-compliant resources fail before deployment

Automate response to a posture event (for example, quarantine a workload or revoke a key) using native automation

Define the operational metrics and alert thresholds for cloud security monitoring

Re-derive the shared responsibility split for a hybrid scenario and identify the gaps

Redesign a broken reference architecture covering routing, inspection, and posture controls

Review weak areas from prior weeks and close each with a targeted lab or written summary

Complete timed practice sets and analyze every miss by domain and root cause