Fortinet FCSS SOC study plan
Fortinet FCSS SOC · Give each week a clear focus.
8 weeks · About 6 hours per week
Security Operations & Network Security
Map the FCSS SOC exam blueprint by writing your own one-page outline of the five domains and weighting each at 20 percent
Define the SOC analyst workflow from alert ingestion through triage, escalation, and closure, and record where FortiAnalyzer and FortiSIEM each fit
Configure a FortiGate lab with logging to FortiAnalyzer and confirm events appear in the log view within one session
List the FortiGuard security fabric components and state in one sentence what each contributes to detection
Your checkpoint
A one-page SOC architecture diagram showing data flow from FortiGate to FortiAnalyzer to FortiSIEM, annotated with the log types each hop carries
Security Operations
Build three FortiSIEM correlation rules that trigger on failed admin logins, repeated deny events, and new device detection
Practice writing FortiAnalyzer reports and saved searches that summarize top sources, destinations, and applications over 24 hours
Trace one simulated incident end to end and document the evidence you would collect at each step
Compare FortiSIEM, FortiSOAR, and FortiAnalyzer roles and write down which one owns playbook automation
Your checkpoint
A written incident runbook for a brute-force login scenario listing detection rule, evidence sources, escalation criteria, and containment action
Network Security
Configure firewall policies with NAT, VIPs, and security profiles on a lab FortiGate and verify traffic behavior with packet captures
Explain how FortiOS processes a packet through policy lookup, session table, and UTM inspection, and diagram the order
Set up an IPsec site-to-site tunnel and an SSL VPN portal, then test both with a client
Configure SD-WAN with two simulated WAN links and observe failover behavior
Your checkpoint
A lab report with configuration excerpts and packet capture evidence proving NAT, IPsec, SSL VPN, and SD-WAN failover each work
Network Security & Unified SASE
Tune IPS and antivirus profiles to reduce false positives on a test traffic mix and record before-and-after alert counts
Describe how FortiGate integrates with the Security Fabric and what fabric telemetry adds to detection
Define ZTNA concepts including application gateways, access proxies, and per-application access rules
Configure a basic ZTNA rule set and test access from an endpoint with and without the client
Your checkpoint
A tuning worksheet showing IPS/AV profile changes, the alert volume before and after, and the ZTNA rule logic you validated
Unified SASE
Compare SSL inspection modes including certificate inspection and deep inspection, and state the tradeoffs of each
Configure web filtering and DNS filtering categories and verify blocked versus allowed outcomes for sample sites
Set up FortiSASE or a SASE lab tenant and connect a remote user through the secure web gateway
Explain how CASB inline and API modes differ and which data they can inspect
Your checkpoint
A SASE configuration summary documenting the secure web gateway policy, SSL inspection choice, and the test results for ten sample destinations
Cloud Security
Deploy a FortiGate VM in a cloud provider and connect it to an existing virtual network with correct routing
Configure cloud-native logging to FortiAnalyzer or a cloud log service and confirm records arrive
Describe the shared responsibility model for a public cloud and map which controls Fortinet products cover
Set up a cloud workload protection or container scanning scenario and interpret one finding
Your checkpoint
A cloud deployment checklist covering VM provisioning, routing, logging pipeline, and one resolved misconfiguration finding with evidence
Operational Technology
Explain how OT network segmentation differs from IT segmentation and identify the Purdue model layers
Configure an OT-aware FortiGate policy set that permits only required industrial protocols between zones
Describe FortiNAC or OT asset discovery and how unknown device detection changes response
Document the safety-first constraints that limit active scanning and blocking in OT environments
Your checkpoint
An OT zone segmentation plan with protocol allowlists per zone boundary and a written justification for each permitted flow
Security Operations & Network Security & Unified SASE & Cloud Security & Operational Technology
Review weak areas from weeks one through seven and rewrite your notes for the three domains where you scored lowest
Build a 40-question self-test spanning all five domains and score at least 80 percent
Re-run the week four and week seven labs from memory without notes to confirm retention
Write a final one-page cheat sheet of commands, log locations, and configuration paths you keep forgetting
Your checkpoint
A scored self-test with an error log listing each missed item, the correct concept, and the domain it belongs to
Milestones
Week 2: You can explain the SOC alert-to-closure workflow and demonstrate a working FortiSIEM correlation rule and FortiAnalyzer report
Week 4: You can build and verify NAT, IPsec, SSL VPN, SD-WAN failover, and a ZTNA rule on a lab FortiGate without step-by-step guidance
Week 6: You can deploy a cloud FortiGate VM with working routing and logging and explain the shared responsibility split
Week 8: You score at least 80 percent on a 40-question mixed-domain self-test and have an error log covering every missed item