FCF-CA Exam Guide: Cost, Study Plan and FortiAuthenticator Lab

What the FCF-CA proves and who it fits

The FCF-CA is the Fortinet FortiAuthenticator Administrator exam. It shows you can run FortiAuthenticator, Fortinet's identity and access management appliance. That means users, authentication methods, certificates and the connections to other systems.

It suits network and security admins who manage logins for firewalls, VPNs, Wi-Fi or internal apps. It also helps if you work with Fortinet gear and want to prove you can handle the authentication side. If you have never touched RADIUS, LDAP or certificates, expect to learn those basics first.

This is a product exam, not a general security exam. You are tested on how one product works, so hands-on time matters more than reading.

What the voucher costs and how delivery works

Our FCF-CA voucher is $114.99 USD (price listed on 2026-11-08). One voucher covers one exam attempt. You can buy it on the FCF-CA voucher page.

Here is how the order works:

• We email the voucher code within 12 hours of payment. It also appears in your account.

• You can cancel an order for a full refund before the code is delivered.

• A delivered code is non-refundable. The exception is when the test provider rejects it as invalid, already used or expired on first use.

• In that case, contact support within 14 days. Send your order number and a screenshot, and we replace or refund the code.

Before you book, check the exam's current duration, question count, passing score and any prerequisites on the official Fortinet Training Institute page for the FCF-CA, because Fortinet can change them.

Topics to study for FortiAuthenticator

Use this table as a study map. It lists the areas an administrator of this product works with every day. It is not the official blueprint, so match it against Fortinet's published exam objectives.

If you must pick priorities, start with RADIUS, two-factor authentication and certificates. Many deployments rely heavily on those three.

A six-week study plan at about 5 hours a week

This plan assumes you already know basic networking and have some Fortinet exposure. It totals about 30 hours. Add a week or two if RADIUS and PKI are new to you.

Keep a notes file with each setting you changed and why. It becomes your revision sheet.

A lab to run: FortiGate VPN login through RADIUS

This exercise ties together users, RADIUS, two-factor authentication and logs. It takes about an hour once the appliance is running.

1. On FortiAuthenticator, create a local user and enable two-factor authentication for it.

2. Add your FortiGate as a RADIUS client. Set a shared secret.

3. Create a RADIUS policy that allows that user group.

4. On the FortiGate, point to the RADIUS server:

config user radius
    edit "FAC-RADIUS"
        set server "192.0.2.10"
        set secret <shared-secret>
    next
end

1. Create a user group on the FortiGate that uses FAC-RADIUS, then use that group for a VPN login. Admin login through RADIUS also needs a matching remote admin account or profile on the FortiGate, so the group alone is not enough for that.

2. Log in with the test user. Because step 1 enabled two-factor authentication, enter the one-time password as well as the password. Expect a token prompt. It is not a failure. Then log in with a wrong password and read the failure in the FortiAuthenticator logs.

Replace 192.0.2.10 with your appliance address. Step 6 matters most. Reading why a login failed is a skill the exam and real work both reward.

Common mistakes to avoid

• Studying only theory. Without a lab you will struggle to recall where each setting lives.

• Skipping time sync. One-time passwords depend on correct time. A clock that drifts causes failed logins.

• Mismatched shared secrets. The RADIUS client and server must use the same secret. This is a frequent cause of failed logins that are hard to spot.

• Ignoring certificate basics. Know the difference between a CA certificate, a server certificate and a user certificate.

• Relying on memorized dumps. They are often outdated and do not teach you to troubleshoot.

• Booking before you read the official format. Confirm the details first, then schedule.

What to do after you pass

Add the credential to your resume and professional profiles, and note which FortiAuthenticator features you configured in your lab. Check Fortinet's certification page for how long the credential stays valid and how renewal works.

If you manage Fortinet firewalls, a natural next step is firewall administration. See our NSE 4 FCP FortiOS Administrator guide. If you manage many devices, our NSE 5 FortiManager Administrator guide covers central management.

Ready to book? Get your FCF-CA voucher and start your lab this week.

Sources

• FCF-CA Fortinet FortiAuthenticator Administrator voucher

• Refund policy

• Delivery policy