FCP-FGT-AD - Deployment and system configuration (20% of the exam) - Section 1.2

Implement the Fortinet Security Fabric to interconnect Fortinet devices and centralise visibility and control.

Describe the Fortinet Security Fabric topology, distinguishing the role of the root FortiGate from downstream FortiGate devices that join the fabric. Configure fabric connectors to centralise visibility and apply coordinated policy enforcement across interconnected Fortinet devices.

Fortinet Security FabricSecurity Fabric topologyroot FortiGatedownstream FortiGate

Practice question for this objective

Free sampleDeployment and system configurationmedium

A downstream FortiGate has been cabled to a root FortiGate and configured with the fabric settings to join the existing Security Fabric. Telemetry discovery is working and the downstream unit is visible to the root, but it remains in a pending state and its data is not trusted into the fabric. The administrator wants the downstream unit to become a full member. Which action on the root FortiGate completes the join?

AEnable the FortiTelemetry discovery protocol on the root's downstream-facing interface, because authorisation happens automatically once telemetry packets are received.
BAuthorise the pending downstream device from the Security Fabric settings or topology on the root FortiGate so the root explicitly trusts that serial number as a member. Correct
CAdd the downstream device as a managed device in FortiManager, which then authorises it back into the Security Fabric on the root's behalf.
DReconfigure the downstream unit's fabric role from downstream to root so both devices share root authority and the pending state clears.

Recognise that a discovered downstream FortiGate must be explicitly authorised on the root before it becomes a trusted Security Fabric member. Security Fabric onboarding is two stages: telemetry discovery surfaces a candidate device to the root, then the root administrator authorises that specific serial number. Until authorisation, the device stays pending and its telemetry is not trusted into the fabric, regardless of working discovery.

Why A is wrong: Tempting because telemetry must be enabled on the connecting interface, but the scenario already has discovery working; reception of telemetry does not auto-authorise a member, an explicit authorisation step is still required.

Why B is correct: Correct: discovery makes a candidate visible, but the root administrator must explicitly authorise the device by its serial number before it is admitted as a trusted fabric member.

Why C is wrong: Tempting because FortiManager manages devices, but fabric membership authorisation is performed on the root FortiGate itself, and the Fabric does not depend on FortiManager to admit members.

Why D is wrong: Tempting because role is part of fabric setup, but a fabric has exactly one root; promoting the downstream unit to root would break the tree rather than authorise it as a member.

See more FCP-FGT-AD practice questions, answers explained.

Exam traps in Deployment and system configuration

Answers that look right on this material and are not. Each one is a distractor from a different question in the FCP-FGT-AD bank for this domain.

The linking interface on the root has device detection disabled, which prevents the root from rendering the downstream in the topology even though the join itself succeeds.
Why it is wrong: Device detection populates the topology with discovered endpoints and devices, but its absence would not stop the fabric join itself, so the downstream would still appear as a member; the symptom here is no join at all.
Automatic synchronisation of every member's local administrator passwords and per-device routing tables so all units hold identical credentials and routes.
Why it is wrong: This is tempting because members are interconnected, but the fabric does not synchronise local admin passwords or routing tables; those stay device-specific.
Configure the device as a downstream FortiGate so it can discover the existing root over the fabric automatically.
Why it is wrong: Downstream is the role for units beneath the top of the tree; making the top unit downstream is tempting if the roles are reversed in your mind, but the top device must be root or there is no anchor for the tree.

Examworthy is not affiliated with or endorsed by Fortinet. Original, blueprint-aligned practice material only.