Fortinet Certified Professional - Security Operations (FCP - SOC) — Questions and Answers

Question 1: How does the FCP body of knowledge relate to daily professional practice?

It is theoretical with limited application
It provides the foundational framework guiding decision-making and standard practices (Correct answer)
It is only for academic research
It only applies during exams

Correct answer: It provides the foundational framework guiding decision-making and standard practices

The body of knowledge provides the framework guiding daily decision-making and practices.

Question 2: Which FortiSIEM protocol integration is commonly used to pull performance and availability metrics from network devices?

SMTP
LDAP
RADIUS
SNMP (Correct answer)

Correct answer: SNMP

FortiSIEM uses SNMP to poll network devices for performance counters, interface statistics, and availability data for infrastructure monitoring.

Question 3: What is the significance of the FortiSIEM 'Risk Score' assigned to devices?

It rates the cost of replacing the device if compromised
It indicates the number of open SNMP ports on the device
It measures the network bandwidth consumed by the device
It quantifies the combined threat and vulnerability exposure of a device based on recent incidents and scan data (Correct answer)

Correct answer: It quantifies the combined threat and vulnerability exposure of a device based on recent incidents and scan data

FortiSIEM's Risk Score combines incident severity, vulnerability data, and asset criticality to give each device a composite risk rating for prioritized response.

Question 4: What is the primary purpose of SOAR (Security Orchestration, Automation and Response) in a security operations center?

To replace human analysts entirely with AI-driven decisions
To automate repetitive security tasks and orchestrate tools for faster incident response (Correct answer)
To store and archive all security logs in a central repository
To scan networks for open ports and vulnerabilities

Correct answer: To automate repetitive security tasks and orchestrate tools for faster incident response

SOAR platforms automate repetitive tasks such as alert triage and coordinate multiple security tools to accelerate incident response and reduce analyst workload.

Question 5: In FortiSOAR, which feature allows a playbook to pause and wait for a human analyst to approve or reject an action before continuing?

Threat Intelligence Feed
Approval-based (human-in-the-loop) step (Correct answer)
Incident Commander
War Room

Correct answer: Approval-based (human-in-the-loop) step

FortiSOAR supports human-in-the-loop steps within playbooks, which pause automated execution and request analyst approval before proceeding with high-impact actions.

Question 6: Which Fortinet product is the dedicated SOAR solution for automating security workflows and managing incidents?

FortiAnalyzer
FortiManager
FortiSOAR (Correct answer)
FortiSIEM

Correct answer: FortiSOAR

FortiSOAR is Fortinet's purpose-built SOAR platform that provides playbook automation, case management, and integrations for orchestrated incident response.

Question 7: How should a FCP professional manager address underperformance?

Immediately reassign the individual
Ignore it until formal reviews
Provide timely, specific feedback with support and a clear improvement plan (Correct answer)
Address publicly in team meetings

Correct answer: Provide timely, specific feedback with support and a clear improvement plan

Timely, specific feedback with support gives individuals a fair opportunity to improve.

Question 8: What is the key difference between automation and orchestration in the context of SOAR?

Automation handles multi-tool coordination while orchestration handles single-task execution
Orchestration only applies to cloud environments; automation applies to on-premises systems
Automation executes individual tasks without human intervention; orchestration coordinates multiple tools and processes to accomplish a broader workflow (Correct answer)
There is no practical difference — the terms are interchangeable

Correct answer: Automation executes individual tasks without human intervention; orchestration coordinates multiple tools and processes to accomplish a broader workflow

Automation refers to executing individual repetitive tasks without human input, while orchestration coordinates the flow across multiple tools and processes to achieve an end-to-end response.

Question 9: What FortiAnalyzer feature enables long-term storage of raw logs in a compressed archive format?

Dataset queries
Log archiving (Correct answer)
Real-time monitoring
ADOM replication

Correct answer: Log archiving

FortiAnalyzer's log archiving feature compresses and stores raw logs for extended periods to meet compliance and forensic investigation needs.

Question 10: Which FortiAnalyzer report template is most useful for providing executive leadership with a weekly summary of security posture and top threats?

Raw Syslog Export
Interface Statistics Report
Executive Summary Report (Correct answer)
VPN Usage Report

Correct answer: Executive Summary Report

The Executive Summary Report in FortiAnalyzer presents high-level KPIs, top threats, and trend data in a format suitable for non-technical leadership.

Question 11: What is the function of FortiSIEM's 'Real-Time Search'?

Scanning the network for new devices in real time
Running pre-scheduled reports on historical data
Synchronizing FortiSIEM rules with FortiGuard
Querying incoming events live as they arrive without needing a stored log index (Correct answer)

Correct answer: Querying incoming events live as they arrive without needing a stored log index

Real-Time Search in FortiSIEM lets analysts filter and examine events as they stream in, enabling immediate threat hunting without waiting for indexing.

Question 12: In FortiSOAR, what is a playbook?

A document containing contact information for the incident response team
A dashboard showing real-time threat metrics
A firewall policy set that blocks known malicious IPs
A visual, automated workflow that defines the sequence of actions taken in response to a security event (Correct answer)

Correct answer: A visual, automated workflow that defines the sequence of actions taken in response to a security event

A playbook in FortiSOAR is a visual automated workflow — a series of defined steps and decisions executed in response to a specific alert or event type.

Question 13: What does MTTR stand for, and how does SOAR directly impact it?

Median Ticket Transfer Rate; SOAR routes tickets between teams automatically
Mean Time to Remediate; SOAR increases it by adding workflow complexity
Maximum Threat Tolerance Ratio; SOAR tracks it via dashboards
Mean Time to Respond; SOAR reduces it by automating triage and response actions (Correct answer)

Correct answer: Mean Time to Respond; SOAR reduces it by automating triage and response actions

MTTR (Mean Time to Respond) measures how quickly incidents are addressed; SOAR reduces MTTR by automating alert triage, enrichment, and response steps that would otherwise require manual effort.

Question 14: Which FortiAnalyzer feature helps administrators visualize the network topology of connected Security Fabric devices?

ADOM device list
Log field explorer
Security Fabric topology view (Correct answer)
Dataset query builder

Correct answer: Security Fabric topology view

The Security Fabric topology view in FortiAnalyzer displays a graphical map of all connected Fortinet devices and their relationships within the fabric.

Question 15: What is a common troubleshooting step?

Ignore logs.
Check logs (Correct answer)
Delete configurations.
Restart device blindly.

Correct answer: Check logs

Checking logs is a fundamental and often first step in troubleshooting any IT or security issue. Logs provide detailed records of system events, errors, and security alerts, offering invaluable clues to diagnose problems and understand their origin. Analyzing logs helps pinpoint the exact time and nature of an issue, guiding the resolution process effectively.

Question 16: What is FortiGate?

An email client.
VPN provider.
Cloud storage.
Firewall product (Correct answer)

Correct answer: Firewall product

FortiGate is Fortinet's flagship product, primarily known as a next-generation firewall (NGFW). It provides comprehensive network security functions, including intrusion prevention, VPN capabilities, web filtering, and application control. FortiGate devices serve as a cornerstone of the Fortinet Security Fabric, protecting networks from various cyber threats.

Question 17: An organization wants to prevent shadow IT by blocking unsanctioned SaaS applications. Which FortiGate feature provides application-level policy control for this use case?

URL category filtering
Web rating overrides
Application control profiles (Correct answer)
DNS filtering with FortiGuard

Correct answer: Application control profiles

Application control profiles classify and block specific applications (including SaaS) at the policy level using deep packet inspection.

Question 18: A FortiGate policy is configured with action 'accept' but traffic is still being blocked. After checking all explicit deny rules, what should the administrator investigate next?

Policy order—a higher-priority deny rule may match first (Correct answer)
FortiManager ADOM lock status
SD-WAN rule priority
FortiAnalyzer correlation rules

Correct answer: Policy order—a higher-priority deny rule may match first

FortiGate evaluates policies top-to-bottom; a deny rule earlier in the list that also matches the traffic will take effect before the accept rule is reached.

Question 19: How frequently should ongoing assessments be conducted in Fortinet Certified Professional Security Operations practice?

Only when problems are reported
Only when required by external auditors
Once annually regardless of circumstances
At regular intervals and as conditions change (Correct answer)

Correct answer: At regular intervals and as conditions change

Ongoing assessments should follow established protocols and also respond to changing conditions.

Question 20: Which protocol does FortiAnalyzer primarily use to receive logs from FortiGate devices?

Fortinet proprietary encrypted protocol (oftp) (Correct answer)
SNMP traps
NetFlow v9
Syslog over UDP

Correct answer: Fortinet proprietary encrypted protocol (oftp)

FortiGate sends logs to FortiAnalyzer using the Fortinet-proprietary oftp (object file transfer protocol) over an encrypted SSL channel.

Question 21: Which FortiSIEM integration allows it to automatically create and update tickets in external ITSM platforms?

Syslog relay to ITSM syslog listener
SNMP trap forwarding to ITSM agents
Ticketing system integration via REST API or built-in connectors (e.g., ServiceNow, Jira) (Correct answer)
FortiSIEM native help desk module

Correct answer: Ticketing system integration via REST API or built-in connectors (e.g., ServiceNow, Jira)

FortiSIEM integrates with ITSM platforms like ServiceNow and Jira via REST API connectors, automatically creating or updating tickets when incidents are detected.

Question 22: Which FortiGate feature detects when a managed device's running configuration diverges from the approved baseline stored in FortiManager?

FortiGate SNMP trap on config change
Configuration drift detection via FortiManager's 'retrieve' and diff comparison (Correct answer)
FortiAnalyzer anomaly detection
Security Fabric topology alerts

Correct answer: Configuration drift detection via FortiManager's 'retrieve' and diff comparison

FortiManager can retrieve the current running configuration from a managed device and compare it to the stored revision, highlighting any configuration drift.

Question 23: Which integration mechanism does FortiSOAR primarily use to connect with third-party security tools?

Syslog over UDP
REST API connectors (Correct answer)
SNMP traps
LDAP queries

Correct answer: REST API connectors

FortiSOAR uses REST API-based connectors to integrate with third-party tools, enabling data exchange and action execution across the security ecosystem.

Question 24: In FortiSIEM, what is a 'Rule' used for?

Defining correlation logic that triggers incidents when event patterns are matched (Correct answer)
Creating network diagrams
Scheduling vulnerability scans
Configuring firewall access policies

Correct answer: Defining correlation logic that triggers incidents when event patterns are matched

Rules in FortiSIEM define event correlation conditions — when logs match the specified pattern, FortiSIEM automatically generates an incident.

Question 25: In FortiAnalyzer, what is the function of a 'report schedule'?

Automatically generating and distributing reports at defined times (Correct answer)
Refreshing ADOM membership lists
Rotating log archive files weekly
Scheduling firmware upgrades on managed devices

Correct answer: Automatically generating and distributing reports at defined times

Report schedules automate the generation and email distribution of reports at configured intervals, reducing manual administrative effort.

Question 26: What is the primary function of FortiSIEM in a security operations environment?

WAN optimization and traffic acceleration
Firewall policy deployment across branches
Unified security information and event management combining log correlation, analytics, and compliance (Correct answer)
Endpoint antivirus scanning and remediation

Correct answer: Unified security information and event management combining log correlation, analytics, and compliance

FortiSIEM provides a unified SIEM platform that ingests, correlates, and analyzes logs and events from diverse IT and security sources for threat detection and compliance.

Question 27: When planning a project in Fortinet Certified Professional Security Operations, which element should be established FIRST?

Clear objectives, scope, and success criteria (Correct answer)
Team member assignments
Budget allocation
Project timeline

Correct answer: Clear objectives, scope, and success criteria

Clear objectives and success criteria form the foundation for all other planning decisions.

Question 28: Why is network segmentation important?

Eliminates all threats.
Limits access & impact (Correct answer)
Increases network traffic.
Reduces encryption.

Correct answer: Limits access & impact

Network segmentation divides a network into smaller, isolated segments, each with its own security policies. This is important because it limits unauthorized access to sensitive areas and contains the impact of a security breach. If one segment is compromised, the attack is less likely to spread to other parts of the network, thereby reducing the overall damage and improving security posture.

Question 29: Which FortiAnalyzer feature allows administrators to create automated responses based on log data thresholds?

Report templates
ADOM segmentation
Log forwarding
Event handlers (Correct answer)

Correct answer: Event handlers

Event handlers in FortiAnalyzer let administrators define conditions and trigger automated actions or alerts when log data meets specified thresholds.

Question 30: What is the purpose of a FortiSIEM 'Watch List' in the context of threat detection?

A read-only list of vendor-supplied threat signatures
A list of assets excluded from all correlation rules
A dynamic list of high-risk entities (users, IPs, hosts) that triggers enhanced monitoring rules (Correct answer)
A scheduled report of the top 10 firewall violations

Correct answer: A dynamic list of high-risk entities (users, IPs, hosts) that triggers enhanced monitoring rules

Watch Lists in FortiSIEM allow analysts to flag specific entities for elevated scrutiny, enabling correlation rules to fire with lower thresholds for those entities.

Question 31: What is the purpose of FortiSIEM's 'Identity and Location' feature?

Blocking users from accessing FortiSIEM from unrecognized locations
Mapping IP addresses to user identities and physical or network locations for enriched event context (Correct answer)
Enforcing multi-factor authentication for FortiSIEM admins
Synchronizing geolocation data with FortiGuard threat feeds

Correct answer: Mapping IP addresses to user identities and physical or network locations for enriched event context

FortiSIEM's Identity and Location feature enriches events by resolving IP addresses to user accounts and physical or network locations, improving investigation context.

Fortinet Certified Professional - Security Operations (FCP - SOC)

The FCP - Security Operations certification validates an individual's ability to implement, administer, and monitor Fortinet security operations solutions.

Questions

60 min

Time Limit

65%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

helpdesk.training.fortinet.com — Test delivery, fees, exam information · verified Oct 2026
training.fortinet.com — Exam format, time limit, score release, eligibility, passing score · verified Oct 2026
fortinet.com — Renewal, score validity · verified Oct 2026
pearsonvue.com — Retake policy · verified Oct 2026