NSE4 System and Network Administration Practice Question
A FortiGate administrator needs to allow remote management of a FortiGate from the internet. Which administrative access protocols should be enabled on the WAN interface? (Choose the best single answer.)
⚠ Common exam trap
Candidates often confuse 'administrative access' with 'monitoring or file transfer protocols' (e.g., SNMP, FTP) or fail to recognize that HTTP and Telnet are insecure for internet-facing interfaces, leading them to choose options that include unencrypted protocols.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HTTPS and SSH
HTTPS (port 443) and SSH (port 22) are the only secure administrative access protocols that provide encrypted communication for remote management over the internet. HTTP and Telnet transmit credentials and data in plaintext, making them unsuitable for WAN-facing interfaces. FortiGate best practices mandate disabling all insecure protocols on external interfaces and enabling only HTTPS and SSH for administrative access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ping and SNMP
Why it's wrong here
Ping is an ICMP-based utility used to test network reachability, while SNMP is a protocol for monitoring device counters and status. Neither provides an interactive interface that would allow an administrator to change configuration, run commands, or manage the FortiGate. SNMPv3 can offer encrypted polling, but it is still not designed for remote administrative access like editing firewall policies or viewing the full CLI.
- ✗
HTTP and Telnet
Why it's wrong here
HTTP and Telnet transmit management sessions in plaintext, meaning usernames, passwords, and configuration data can be captured by anyone on the path. FortiGate firmware and security best practices strongly discourage using them for remote administration, and they are often blocked by default. While HTTP and Telnet are technically capable of reaching the management interface, they expose the device to credential theft and session hijacking, making them unacceptable for production environments.
- ✗
FTP and TFTP
Why it's wrong here
FTP and TFTP are file transfer protocols: FTP is used to upload or download files, and TFTP is a lightweight version primarily used for firmware image transfers or configuration backup/restore. Neither gives the administrator an interactive shell or a web-based console to change settings, so they cannot be used to remotely manage the FortiGate's configuration in real time. Moreover, TFTP has no authentication or encryption, and FTP credentials are sent in clear text, so they are not appropriate for management access.
- ✓
HTTPS and SSH
Why this is correct
HTTPS (port 443) provides an encrypted web-based management interface, and SSH (port 22) offers an encrypted command-line session, both ensuring that all administrative traffic remains confidential and tamper-proof. These are the recommended protocols for remote management because they protect login credentials and configuration changes from eavesdropping. FortiGate also allows these protocols to be enabled selectively per interface and with trusted-host restrictions, which is a security best practice.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 773-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.