The master plan uses the code FCP_FGT_AD-7.6, while Fortinet’s current exam page now lists the live credential as Fortinet NSE 4 – FortiOS 7.6 Administrator. The underlying product focus remains FortiOS 7.6.0 and practical FortiGate administration. As of October 2026, this is the current exam for professionals who configure and administer firewall solutions in enterprise network-security environments.
The current FortiGate 7.6 Administrator exam allows 80–90 minutes for 50–55 questions, is offered in English and Japanese, and is scored pass/fail. Fortinet recommends one to two years of networking experience, up to one year of network-security experience, and at least six months of hands-on FortiGate work.
Deployment and system configuration is 20–25%
This domain begins with factory defaults, FortiGuard licensing, administrative access, FortiGate as a DHCP server, configuration backup/restore and firmware upgrades. It also covers logging, FortiAnalyzer registration, HA and troubleshooting of resource or connectivity problems.
The current blueprint additionally includes FortiGate cloud-native firewall and VM deployments plus FortiSASE administration and user-onboarding concepts.
Logging is part of administration, not an afterthought
Administrators need to understand the log workflow, storage options, FortiAnalyzer registration, log search and how logs support troubleshooting. A configuration can look correct while the logs reveal policy mismatch, inspection failure or authentication problems.
FortiView-style visibility and log evidence should be part of the normal operational workflow.
High availability uses FGCP clustering
Current objectives include FortiGate HA, setting changes, session synchronization for seamless failover, HA management interfaces, normal cluster operation and cluster firmware upgrade.
Candidates should distinguish device redundancy from ordinary route redundancy or VPN redundancy. HA preserves firewall service at the appliance level.
Resource and connectivity troubleshooting are explicit
Fortinet tests abnormal behavior monitoring, physical/network-layer problems, packet sniffing and debug flow, high CPU/memory conditions and conserve mode.
This is a strong signal that hands-on diagnosis matters. A firewall-policy question can become a resource or path question when traffic never reaches the expected inspection stage.
Firewall policies and authentication account for 20–25%
This domain covers firewall policies, inspection modes, policy traffic logs, SNAT, DNAT with VIPs, LDAP/RADIUS, active/passive authentication, firewall-user monitoring and Fortinet Single Sign-On.
Policy decisions should always be connected to source, destination, service, identity and inspection behavior.
Content inspection is the largest domain at 25–30%
The exam includes SSL/SSH inspection, certificate trust, web filtering, FortiGuard categories, URL filters, application control, antivirus and IPS.
Inspection-mode differences matter because flow-based and proxy-based operation can affect which features are available and how traffic is processed.
Certificates are central to encrypted-traffic inspection
Full SSL/SSH inspection requires FortiGate to establish trusted inspection relationships and often depends on endpoint trust of a private CA. Certificate warnings, trust-chain problems and application behavior can reveal why encrypted inspection is failing.
Administrators need to know when certificate inspection is sufficient and when deeper inspection is required by the security objective.
Routing represents 10–15%
Static routing, the routing table, redundancy/load balancing and SD-WAN are in scope. Candidates should understand how route selection affects policy and VPN behavior.
SD-WAN adds performance/quality information and policy-driven link selection rather than simply providing another default route.
VPNs represent another 10–15%
The current exam focuses on meshed or partially redundant IPsec VPNs, the IPsec wizard, redundancy, logs and troubleshooting.
A healthy VPN requires correct routing, policy, phase negotiation, peer identity and traffic selectors; “tunnel up” does not automatically prove application reachability.
The current exam is applied administration
Fortinet says the exam includes operational scenarios, configuration extracts and troubleshooting captures. That makes current FortiOS 7.6 hands-on work more valuable than memorizing legacy interface screenshots.
The current exam page’s move to NSE 4 branding changes the program label, not the core FortiOS 7.6 skills. Candidates following older FCP_FGT_AD-7.6 study plans should therefore preserve the 7.6 product objectives while checking current Training Institute wording and logistics before registration.
Initial configuration should include secure administrator access, interface addressing, DNS/NTP where relevant, licensing and configuration backup. A firewall is not ready for policy testing if management access or system time is unreliable, because logs, certificates and authentication can all depend on correct foundational settings.
Firmware upgrade belongs in the deployment domain because version changes can affect feature behavior, configuration compatibility and HA. Administrators should back up configuration, review the supported upgrade path, plan maintenance and verify traffic/security services after the upgrade.
FortiAnalyzer registration matters because centralized logging can improve retention, search and operational visibility. A FortiGate may still process traffic normally while log forwarding is broken, so monitoring health should be validated independently from packet forwarding.
FGCP session synchronization is what makes failover less disruptive for established traffic. HA configuration should therefore be studied beyond “two boxes in a cluster”: heartbeat links, member roles, synchronized state, management access and firmware consistency all affect resilience.
Conserve mode is an important resource-protection behavior. When memory pressure becomes severe, FortiGate may change how it handles sessions or inspection. Candidates should recognize resource symptoms and investigate which process, traffic pattern or configuration is consuming memory instead of blindly rebooting.
FortiGate VM and cloud-native firewall topics expand the exam beyond physical appliances. The administrative principles remain familiar—interfaces, routing, policy, licensing, logging—but the deployment environment introduces cloud networking, images, interfaces and provider-specific constraints.
FortiSASE content reflects remote-work and secure-access patterns. Candidates should understand the purpose of SASE, key FortiSASE components, user onboarding and how remote users receive security controls outside the traditional branch perimeter.
Firewall inspection modes deserve explicit comparison. Flow mode processes traffic in a streaming manner, while proxy mode terminates/proxies supported traffic for deeper handling. Some web-filtering and security-profile behavior differs by mode, so policy design should follow feature and performance requirements.
SNAT and DNAT should be visualized with original and translated packet addresses. Hide/source translation is commonly used for outbound access, while VIP-based DNAT publishes internal services. Logs can show translated sessions and help determine whether the wrong address is being matched.
LDAP and RADIUS are remote authentication services with different common uses, while FSSO can map domain logons to firewall identities without interactive prompts. The current exam expects candidates to know how FortiGate obtains user identity and how authentication problems affect firewall policy.
Full SSL inspection introduces a trust problem because FortiGate dynamically inspects encrypted sessions. Endpoints need to trust the inspection CA where appropriate, and some applications can use certificate pinning or other behavior that requires exceptions. Certificate warnings are evidence, not merely user annoyance.
Web filtering combines FortiGuard categories, static URL filters and inspection behavior. A site can be denied because of category, explicit filter, certificate/inspection issue or policy placement. Troubleshooting should identify which mechanism produced the block.
Application Control looks at application behavior rather than only port numbers. This is valuable because modern applications can share common web ports. The administrator should understand how profiles are attached to policies and how event logs prove classification/action.
Antivirus and IPS address different threats. Antivirus focuses on malicious content/files and supported protocols, while IPS detects exploit/signature behavior in traffic. High CPU associated with IPS is a current troubleshooting topic, so security depth and resource impact need to be balanced.
SD-WAN should be studied as policy-aware path selection over member links. Link quality measurements can influence which WAN is preferred, while routing and firewall policy still govern the resulting traffic. An SD-WAN rule does not eliminate ordinary route and policy dependencies.
Redundant IPsec VPNs connect routing, tunnel state and path availability. When one WAN path fails, the alternative VPN should become usable according to configuration. Candidates should verify both tunnel establishment and real application traffic across the failover path.
For final blueprint review, allocate time according to weights: Content Inspection is largest at 25–30%; Deployment/System and Firewall/Auth are each 20–25%; Routing and VPN are each 10–15%. That balance discourages over-studying one familiar feature such as VPN at the expense of inspection and administration.
DHCP-server functionality is in scope because FortiGate can provide basic network services in branch or small environments. Candidates should understand address pools, gateway/DNS options and how DHCP problems present before firewall policy becomes relevant.
Administrative access should be hardened. Trusted hosts, secure management protocols, appropriate administrator profiles and dedicated management interfaces where available reduce risk. The exam’s initial-configuration domain assumes administrators can distinguish management-plane exposure from user traffic.
Policy logging is operationally important because it provides proof of matching behavior. Without logging, administrators can see that traffic fails but may not know which rule accepted or denied it. Logging strategy should balance evidence with storage and performance considerations.
FSSO should be studied as identity mapping rather than a standalone authentication product. Collector agents or other mechanisms associate domain users with addresses so firewall policies can match user/group identity. Stale mapping or collector communication can cause users to hit unexpected rules.
Inspection exceptions should be deliberate. Some applications, certificate-pinned services or privacy-sensitive destinations may need different SSL-inspection treatment, but broad exemptions reduce security visibility. The administrator should use the smallest exception that satisfies a justified requirement.
FortiGuard categories and threat signatures depend on update connectivity and licensing. When security services behave unexpectedly, verify that the appliance has current subscriptions and can reach update infrastructure before assuming the profile logic is wrong.
The current exam’s cloud and SASE topics should be studied as extensions of FortiGate administration. FortiGate VM/CNF adapts the firewall to cloud environments, while FortiSASE extends security controls to remote users. Both reinforce that FortiOS administration now spans more than one physical appliance at headquarters.
Within the broader Fortinet certification program, this exam validates day-to-day firewall administration across configuration, policy, inspection, routing, VPN, HA, logging and troubleshooting.