Fortinet FCX study guide
Fortinet FCX · Work through your exam, one topic at a time.
The Fortinet FCX (Fortinet Certified Expert) is an expert-level certification from the Fortinet Training Institute, aimed at experienced security and network professionals who design, deploy, and operate Fortinet-based security architectures. The exam spans six domains: FortiOS and Security Fabric architecture (20%), secure networking including NGFW, SD-WAN, switching, and wireless LAN (20%), Unified SASE and secure access (15%), cloud security (15%), security operations covering SOC, SIEM, SOAR, EDR, and NDR (20%), and operational technology security (10%). The Fortinet FCX study guide has 6 sections and about 2,793 words.
01FortiOS and Security Fabric Architecture
The FortiOS and Security Fabric Architecture domain tests the operating system underneath every FortiGate and the way the Fabric links FortiGate, FortiSwitch, FortiAP, FortiAnalyzer, FortiManager, FortiClient EMS and FortiSandbox into one topology that shares telemetry, ratings and automated responses. At FCX level these are design and troubleshooting questions, not definition recall: which unit is root, where an automation actually runs, and why a device joined the Fabric yet contributes nothing.
499 words, about 2 min02Secure Networking (NGFW, SD-WAN, Switching, Wireless LAN)
Secure Networking covers the FortiGate as an NGFW, as an SD-WAN edge and as the controller for FortiSwitch and FortiAP. The exam tests whether you can predict which policy, SD-WAN rule or VLAN will win for a given packet, and whether you know which knob is evaluated first.
491 words, about 2 min03Unified SASE and Secure Access
Unified SASE and Secure Access tests how users reach private applications and the internet without a blanket tunnel: ZTNA on FortiOS, SSL VPN and IPsec dial-up, FortiClient and EMS posture, FortiAuthenticator identity, FortiCASB for SaaS and cloud-delivered FortiSASE. Expect scenario questions about what gets evaluated in which order when a remote laptop opens an internal app.
490 words, about 2 min04Cloud Security
Cloud Security tests how Fortinet controls are deployed and operated in AWS, Azure and GCP: FortiGate-VM sizing and licensing, HA without Layer 2, insertion through cloud load balancers, auto-scaling, cloud SDN connectors, FortiCNP for posture and FortiCASB for SaaS. The questions are usually "why did traffic drop" or "why did failover not move the address".
459 words, about 2 min05Security Operations (SOC, SIEM, SOAR, EDR, NDR)
Security Operations covers the detection-to-response chain: FortiAnalyzer for logging and event handlers, FortiSIEM for correlation, FortiEDR and FortiNDR for endpoint and network detection, FortiSandbox for verdicts, FortiDeceptor for lures and FortiSOAR for orchestration. The exam tests whether you know which platform owns which step, because a chain with one broken link produces alerts nobody acts on.
413 words, about 2 min06Operational Technology Security
OT Security tests protecting industrial control systems where availability and safety outrank confidentiality. You need the reference models (Purdue, IEC 62443), the protocol and port vocabulary, and the Fortinet components used at plant boundaries: FortiGate Rugged, FortiSwitch Rugged, FortiAP, FortiDeceptor, FortiNDR and OT signature coverage feeding FortiAnalyzer and FortiSIEM.
441 words, about 2 min