Fortinet FCSS SOC flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

SOC Tier 1 role

Tier 1 analysts validate alerts, filter false positives, and escalate confirmed incidents to Tier 2. They do not perform deep malware analysis or threat hunting.

FortiSIEM rule components

A FortiSIEM rule has a filter clause, an aggregation clause, and a time window with a threshold. It fires when the aggregated count exceeds the threshold.

MTTD formula

Mean time to detect equals the sum of (detection timestamp minus event timestamp) across incidents divided by the number of incidents. Lower values indicate faster detection.

FortiSOAR playbook trigger

The trigger is the first node in a FortiSOAR playbook. It can be an incident creation, an event, a schedule, or a manual launch, and it determines the input payload.

IOC enrichment order

Enrich indicators by checking hash reputation first, then IP and domain reputation, then WHOIS and ASN data, and finally sandbox detonation before deciding on containment.

ATT&CK lateral movement tactic

Lateral movement covers techniques an adversary uses to move from one compromised host to another inside a network, such as remote services or pass-the-hash.

FortiAnalyzer log retention

FortiAnalyzer stores analytics logs for a configurable period, defaulting to seven days, and can retain up to 365 days depending on disk capacity and license.

FortiGate first-match policy

FortiGate evaluates firewall policies from top to bottom and applies the first policy whose source, destination, service, and schedule match the traffic. An implicit deny follows.

Flow vs proxy inspection

Flow-based inspection scans packets as they pass and is ASIC-accelerated. Proxy-based inspection buffers content for full antivirus and DLP inspection but reduces throughput.

FGCP HA failover triggers

FortiGate FGCP active-passive HA fails over when a monitored interface loses link, heartbeat is lost on all HA interfaces, or a monitored IP address becomes unreachable.

IPsec phase 1 purpose

Phase 1 negotiates the IKE security association, covering authentication method, Diffie-Hellman group, encryption, and lifetime. It establishes a secure channel for phase 2.

SD-WAN SLA health check

An SD-WAN SLA health check probes a target and measures latency, jitter, and packet loss. A member failing the SLA is removed from rule selection until it recovers.

Deep SSL inspection

Deep inspection re-signs TLS traffic using the FortiGate CA certificate, allowing antivirus and DLP to see plaintext. Endpoints must trust the FortiGate CA.

FortiManager ADOM backup mode

In backup ADOM mode FortiManager stores device configuration backups but does not push policy packages. It is used for configuration archival, not centralized management.

FortiGate implicit deny

Traffic that matches no explicit firewall policy is dropped by the implicit deny at the end of the policy table. The implicit deny is not editable.

SASE definition

Secure Access Service Edge combines SD-WAN with Security Service Edge, which includes secure web gateway, CASB, ZTNA, and firewall as a service.

ZTNA access rule order

A ZTNA rule evaluates the application, then the identity provider group, then device posture, and finally the allow or deny action. Posture can be a precondition.

CASB inline vs API

Inline CASB inspects traffic in real time and can block violations. API CASB scans sanctioned SaaS data at rest and reports violations but cannot block in real time.

FortiSASE deployment modes

FortiSASE can be deployed cloud-native through FortiSASE points of presence, hybrid with a FortiGate on-ramp, or agent-based with FortiClient on endpoints.

ZTNA vs VPN access

ZTNA grants per-application access with continuous posture checks. VPN grants network-level access after a single authentication and does not re-check posture.

SWG policy order

Secure web gateway policy in FortiSASE evaluates explicit proxy rules, then SSL inspection, then web filter, then application control, then DLP, with first match winning.

Device posture signals

FortiSASE posture checks include OS version, antivirus status, disk encryption, and FortiClient registration. Each signal is evaluated independently to allow or deny access.

FortiSASE licensing model

FortiSASE is licensed per user with bandwidth tiers. The point of presence is chosen by nearest region and affects latency, not the security policy applied.

FortiGate-VM BYOL vs on-demand

BYOL uses a permanent or FortiFlex license and supports more VDOMs. On-demand is pay-as-you-go through a cloud marketplace and has fewer features enabled.

FortiCNP cloud role

FortiCNP uses read-only cloud provider roles to assess posture and scan workloads agentlessly. It does not sit inline and cannot block traffic.

Cloud security group evaluation

Cloud security groups are stateful and enforced at the hypervisor layer before traffic reaches a FortiGate-VM. Both layers must permit traffic for it to pass.

FortiCASB API permissions

FortiCASB connects to SaaS using API credentials that are read-only by default. Write permissions are needed for remediation such as quarantining users or revoking shares.

Terraform FortiOS policy resource

The fortios_firewall_policy resource creates a firewall policy. Address object dependencies must be declared explicitly, or the apply fails due to missing references.

Cloud shared responsibility

The cloud provider secures physical infrastructure and the hypervisor. The customer secures identity, data, and configuration. Fortinet cloud tools cover only the customer side.

Purdue model DMZ level

Level 3.5 of the Purdue model is the industrial DMZ between operations and enterprise networks. A FortiGate is commonly deployed at this level to enforce conduits.

Modbus TCP port

Modbus TCP uses port 502. FortiGate IPS signatures detect Modbus anomalies, but deep content inspection is limited because the protocol lacks authentication.

IEC 62443 zones and conduits

Zones group assets by required security level. Conduits are the controlled communication paths between zones, implemented on FortiGate as firewall policies.