NSE4 System and Network Administration Practice Question
A FortiGate administrator needs to allow remote management from the internet only from a specific IP address. Which configuration achieves this?
⚠ Common exam trap
Many candidates confuse firewall policies (which control traffic passing through the FortiGate) with local-in policies (which control traffic destined to the FortiGate), leading them to incorrectly select option D, thinking a standard firewall policy can restrict management access from the internet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a local-in policy to allow management access only from the trusted host
A local-in policy is the correct method to restrict remote management access to a FortiGate from the internet because it operates at the control plane level, filtering traffic destined to the FortiGate itself before it reaches the management daemons. By specifying a source IP address in a local-in policy, you can explicitly allow HTTPS or SSH management only from that trusted host, while implicitly denying all other sources. This is more secure than relying on firewall policies, which apply to traffic passing through the FortiGate, not to traffic destined to the FortiGate's own IP addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a local-in policy to allow management access only from the trusted host
Why this is correct
A local-in policy is evaluated before any firewall policy and explicitly governs traffic destined to the FortiGate's own IP addresses. By defining a local-in rule that permits management traffic only from the specified trusted host IP, the administrator ensures all other sources are implicitly denied, providing precise source-based access control for the management interface.
- ✗
Change the admin port to a non-standard port
Why it's wrong here
Altering the admin port to a non-standard port relies on security through obscurity and does not restrict which source IP addresses can initiate a connection. An attacker who scans or discovers the new port can still attempt management access from any host, so this measure alone fails to enforce a trusted-host restriction and leaves the management interface exposed.
- ✗
Enable HTTPS and restrict admin access via admin host
Why it's wrong here
While the admin host feature does restrict management access to a configured set of source IP addresses, it is a static setting applied broadly to the admin account rather than a granular, interface-level filter. Local-in policies offer independent, ordered control that can also enforce protocol-specific limits and are evaluated earlier in the packet flow, making them a more robust and precise mechanism for source IP restriction.
- ✗
Use a firewall policy with source address restriction
Why it's wrong here
A regular firewall policy is designed for traffic that traverses the FortiGate between its interfaces, not for traffic destined to the FortiGate itself. Since management sessions are terminated by the FortiGate's own TCP/IP stack, they bypass the normal forwarding path and therefore cannot be filtered by a standard firewall policy; only a local-in policy can govern such control-plane traffic.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.