FCP_FMG_AD-7.6

The Fortinet FCP_FMG_AD-7.6 exam (FortiGate Certified Professional - FortiManager & FortiAnalyzer Administration 7.6) focuses on administering FortiManager and FortiAnalyzer in a FortiGate security fabric. The main points covered include:

FortiManager:

• Device Management: This is a core component. Expect questions on adding, configuring, and managing FortiGate devices within FortiManager. This includes tasks like:

  • Device provisioning and onboarding.
  • Configuration management (pushing and pulling configs, template-based deployments).
  • Firmware upgrades and updates.
  • Monitoring device status and health.
  • Managing device groups and hierarchies.
  • Role-based access control (RBAC) for managing administrative privileges.

• Policy Management: Centralized policy management is a key benefit of FortiManager. You'll need to know how to:

  • Create, edit, and deploy security policies (firewall, VPN, etc.) across multiple FortiGates.
  • Manage policy packages and version control.
  • Understand policy inheritance and how it affects different device groups.
  • Utilize policy templates for streamlined configuration.

• Reporting and Monitoring: While FortiAnalyzer handles more in-depth reporting, FortiManager provides some basic reporting capabilities. You should be familiar with:

  • Monitoring device status and performance.
  • Generating basic reports on device configurations and policy deployments.

FortiAnalyzer:

• Log Collection and Correlation: This is a central function. Expect questions on:

  • Configuring FortiAnalyzer to receive logs from multiple FortiGate devices.
  • Understanding different log collection methods.
  • Using FortiAnalyzer to correlate logs from various sources for threat analysis.

• Reporting and Analysis: FortiAnalyzer offers extensive reporting. You need to know how to:

  • Generate various reports (traffic, security events, etc.).
  • Customize reports based on specific criteria.
  • Analyze logs to identify security threats and incidents.
  • Understand different reporting formats (graphs, tables, etc.).
  • Utilize search features for specific events or patterns.

• Alerting and Notification: FortiAnalyzer can be configured to trigger alerts based on specific events. You should be familiar with:

  • Setting up alert thresholds and notifications.
  • Configuring email or other notifications for critical events.

Overall Exam Focus:

• Integration: The exam heavily emphasizes the integration between FortiManager and FortiAnalyzer, and how they work together to manage and monitor a FortiGate security fabric.
• Troubleshooting: You'll encounter scenarios requiring troubleshooting common configuration issues within FortiManager and FortiAnalyzer.
• Best Practices: The exam tests your understanding of best practices for deploying and managing FortiManager and FortiAnalyzer in a production environment.

Remember to consult the official Fortinet documentation and training materials for the most accurate and up-to-date information. Practice labs are highly recommended for success on this exam.