FCP Cheat Sheet 2026

The 30 highest-yield FCP facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. When documenting assessment findings in FCP practice, which approach is MOST appropriate? → Record objective findings, measurements, and observations factually
2. What is the function of FortiSIEM's 'Real-Time Search'? → Querying incoming events live as they arrive without needing a stored log index
3. Which of the following is a key metric used to measure the effectiveness of a SOAR implementation in a SOC? → Reduction in Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)
4. What happens if policies are not followed? → Risks & penalties
5. In a FortiGate SD-WAN deployment, what is the purpose of a Performance SLA? → To monitor link quality metrics like latency, jitter, and packet loss
6. Which protocol does FortiAuthenticator use to integrate with Active Directory for user authentication? → LDAP
7. When implementing a least-privilege firewall policy, which FortiGate practice best represents this principle? → Creating specific source/destination/service policies and ending with an implicit deny
8. A SOC manager needs to demonstrate that security policies are enforced 24/7. Which FortiAnalyzer report type provides continuous policy compliance evidence? → Traffic summary reports with policy hit counts over time
9. What is the MOST effective way for new FCP professionals to build competency? → Combining formal education, mentored practice, and ongoing professional development
10. Which FortiAnalyzer component allows administrators to build custom queries against the log database? → Datasets
11. What is the purpose of log forwarding in FortiAnalyzer? → To send logs to a third-party SIEM or another FortiAnalyzer
12. Why is policy review important? → Keep policies updated
13. What distinguishes a Fortinet Certified Professional Security Operations certified professional from a non-certified practitioner? → Certification validates competency through standardized assessment against benchmarks
14. What data format is most commonly used for sharing threat intelligence indicators between SOAR platforms and threat intelligence tools? → STIX/TAXII
15. What does Fortinet provide? → Cybersecurity solutions
16. Which assessment method provides the MOST reliable data for FCP professionals making critical decisions? → Standardized tools combined with professional observation
17. Why is training important for compliance? → Understand policies
18. What is the MOST effective way for new FCP professionals to build competency? → Combining formal education, mentored practice, and ongoing professional development
19. What is the PRIMARY purpose of obtaining FCP certification in Fortinet Certified Professional Security Operations? → To demonstrate verified competency and adherence to professional standards
20. What does UTM stand for in the context of FortiGate security features? → Unified Threat Management
21. Which foundational principle is MOST important for success in Fortinet Certified Professional Security Operations? → Commitment to continuous learning, ethical practice, and quality outcomes
22. Which MITRE ATT&CK tactic does FortiDeceptor primarily address by luring attackers into interacting with honeypot assets? → Discovery
23. Which disk quota setting in FortiAnalyzer controls how much storage each ADOM can use? → ADOM disk quota
24. Which statement BEST describes the relationship between Fortinet Certified Professional Security Operations certification and industry evolution? → Requirements evolve periodically to reflect advances in knowledge and practice
25. A SOC team wants to measure how quickly they detect intrusions after attacker entry. Which metric does this represent? → Mean Time to Detect (MTTD)
26. Why is coordination important in Security Fabric? → Unified threat response
27. What is an incident response plan? → Predefined procedures
28. Which FortiGate NAT mode translates many private IP addresses to a single public IP using port numbers to differentiate sessions? → Dynamic NAT with PAT (IP masquerading)
29. What is the purpose of the FortiAnalyzer 'Indicators of Compromise' (IoC) feature? → Automatically flagging log events that match known threat intelligence patterns
30. In FortiAnalyzer, what does the 'Fabric Analytics' feature enable? → Correlating data across multiple Fortinet devices in the Security Fabric