FCP - Security Operations practice examsIn development
Fortinet Certified Professional - Security Operations
The detection and response half of the Fortinet portfolio: which product answers which requirement, endpoint protection split between blocking a known-bad file and intercepting what a running process attempts, sandbox verdicts shared across the fabric with their limits, and decoys producing high-confidence alerts; then analytics against archive retention deciding investigative reach, correlation across sources mapped to attack techniques, playbooks that automate the reversible and gate the irreversible, and the alert-to-incident ratio as the health measure.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| The security operations stack and detection | Not published |
| Logging, correlation, response and operations | Not published |
Two sample questions
1. Which practice validates that a detection actually fires?
- Reviewing the rule logic with a second analyst
- Executing the technique in a controlled test — correct
- Checking the source is still reporting events
- Mapping the rule to the framework technique
Why: Controlled execution of the technique verifies the detection genuinely fires rather than assuming it would.
2. Which basis should that new detection use?
- The hash of every binary the adversary was seen to deploy
- The durable behaviour observed rather than the specific artefact — correct
- The addresses that the adversary's own infrastructure resolved to
- The asset on which the activity was first observed to occur
Why: Building on the behaviour keeps the detection working when the adversary changes files and infrastructure.
The real FCP - Security Operations exam
| Length | 60 minutes |
|---|---|
| Questions | 30 to 40 |
| Pass mark | Scaled score; Fortinet does not publish the percentage |
| Price | Purchased per attempt through Pearson VUE |
| Recommended before you sit it | None enforced. The associate level and hands-on experience with the products are assumed. |
| Valid for | 2 years |
Exam facts as published by Fortinet; always check the vendor’s page before you book.
Study FCP - Security Operations with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.