Fortinet FCX study plan

Diagram the Security Fabric from memory: list the components (FortiGate, FortiManager, FortiAnalyzer, FortiSwitch, FortiAP, EMS, FortiClient, FortiNAC, FortiMail, FortiWeb, FortiSandbox, FortiSIEM, FortiSOAR, FortiEDR) and draw the telemetry and management paths that connect them.

Explain how FortiOS handles traffic: describe the packet flow through ingress, routing/doS policy, firewall policy, UTM inspection, and egress, and identify where each security profile is evaluated.

Compare FortiGate deployment modes (NAT, transparent, and VDOM partitioning) and state one operational consequence of each for Fabric topology design.

Describe how Security Fabric connectors (Fabric, FortiManager, FortiAnalyzer, Syslog, and automation stitches) exchange data, and outline what breaks when a connector is misconfigured.

Build a firewall policy set on a FortiGate lab VM or EVE-NG instance: create address and service objects, order policies, and verify traffic with log output.

Configure a basic SD-WAN setup with two WAN links and a performance SLA, then force a failover and confirm the behavior in logs.

Configure a FortiSwitch and FortiAP behind the FortiGate and verify VLAN assignment and wireless client association.

Differentiate NGFW inspection profiles (IPS, antivirus, web filter, application control, SSL inspection) and identify which profile applies to which traffic class.

Configure FortiManager and FortiAnalyzer to manage and log from your lab FortiGate, and verify that policies and logs propagate.

Design a multi-VDOM architecture for a branch and headquarters, and justify the VDOM split in writing.

Troubleshoot a deliberately broken routing or policy scenario and record the diagnostic steps you used (debug flow, packet capture, log filters).

Review FortiOS CLI and GUI navigation for common Fabric and networking tasks, and time yourself on five routine operations.

Map the SOC workflow from alert ingestion to response, and place FortiSIEM, FortiSOAR, FortiEDR, and FortiNDR at their correct points in that flow.

Explain how FortiEDR detects and responds to endpoint threats, including the difference between prevention, detection, and post-infection blocking.

Write two FortiSOAR playbooks on paper: one phishing triage and one compromised-host containment, with triggers, actions, and approval steps.

Describe the telemetry FortiNDR and FortiSIEM consume, and identify the log sources required for a given detection scenario.

Design a SIEM correlation rule for a specific attack pattern (for example, repeated failed logins followed by success) and specify fields, thresholds, and alert output.

Configure FortiSASE or the SASE integration in a lab: enroll a client, apply a web filter and ZTNA rule, and verify the traffic path.

Explain ZTNA versus traditional VPN, and describe how FortiClient, FortiGate, and the SASE service cooperate on identity-based access.

Describe how FortiAuthenticator and FortiToken support MFA and SSO in a SASE or VPN deployment.

Compare the public-cloud security offerings (FortiGate VM in the cloud, FortiCNAPP, FortiCASB, and cloud-native integrations) and state the use case for each.

Deploy a FortiGate VM in a cloud free tier or lab and configure a policy to inspect traffic to a test workload.

Explain cloud shared-responsibility boundaries and identify which controls remain the customer's in IaaS, PaaS, and SaaS.

Describe how the Security Fabric extends into cloud accounts, including how cloud connectors report inventory and findings to FortiAnalyzer or FortiCNAPP.

Identify the characteristics of OT environments (Purdue model levels, protocols such as Modbus and DNP3, uptime constraints) and explain why IT security controls cannot be applied unchanged.

Describe how FortiGate, FortiNAC, and FortiSIEM are used to segment, monitor, and detect in OT networks, including passive monitoring options.

Design a zone-and-conduit segmentation plan for a plant network and justify the placement of each enforcement point.

Explain how the Security Fabric provides visibility across IT and OT, and what data must be normalized to make it useful.

Re-derive the exam weightings and allocate your remaining study time to the weakest two domains.

Take a timed practice set of at least 60 mixed questions and log every miss by domain and root cause.

Re-teach your three weakest topics aloud or in writing without notes, and correct the gaps you find.

Review all prior deliverables and consolidate them into a single one-page pre-exam summary sheet.