NSE4 System and Network Administration Practice Question
A network administrator is configuring a FortiGate for the first time and needs to enable administrative access via HTTPS from the internal network. Which configuration step is required?
⚠ Common exam trap
Candidates often confuse firewall policies (which control traffic passing through the FortiGate) with local-in policies (which control traffic destined to the FortiGate), leading them to incorrectly select Option C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the administrative access to HTTPS on the internal interface
Administrative access to a FortiGate interface is controlled per-interface under the interface configuration. By default, HTTPS access is disabled on all interfaces. To enable administrative HTTPS access from the internal network, you must set the administrative access to HTTPS on the specific internal interface. This allows the FortiGate to listen for HTTPS management traffic on that interface's IP address.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set the administrative access to HTTPS on the internal interface
Why this is correct
To manage a FortiGate via HTTPS on a specific interface, you must explicitly enable HTTPS in the interface's administrative access settings. This is done with `config system interface` and `set allowaccess https` (or `set allowaccess ping https ...`), which tells the control plane to accept HTTPS sessions destined to that interface's IP address. Without this setting, even if the interface has a valid IP and the firewall permits HTTP(S) traffic, the FortiGate will drop management connection attempts.
- ✗
Enable HTTPS on the system global settings
Why it's wrong here
There is no system-wide 'Enable HTTPS' toggle in FortiGate's global configuration. While global settings like `config system global` contain parameters such as `admin-https-ssl-versions` and `admin-server-cert`, the decision to accept HTTPS management sessions is made per interface via the `allowaccess` attribute. Attempting to look for a global switch confuses the per-interface management plane control with the global TLS/SSL settings that only influence how HTTPS behaves once enabled. Thus, setting a global option alone will not open the management GUI on any interface.
- ✗
Create a firewall policy allowing inbound HTTPS from internal to the FortiGate
Why it's wrong here
A firewall policy controls traffic that the FortiGate forwards between its interfaces (e.g., from internal to WAN); it has no bearing on traffic destined to the FortiGate's own IP addresses, which is classified as management plane traffic. Incoming HTTPS management requests are matched against the interface's `allowaccess` setting and, separately, by local-in policies if configured, but not by regular firewall policies. Creating a policy for inbound HTTPS from internal to the FortiGate would either be ignored or, depending on the destination, may not be the correct object. The correct way is to adjust the interface's administrative access.
- ✗
Configure a static route for the management subnet
Why it's wrong here
Management connections to a FortiGate interface's IP address are treated as local traffic because that IP is directly connected to the FortiGate; therefore, no static route is required for the FortiGate to receive those HTTPS packets. A static route would only be necessary to reach subnets that are behind the FortiGate (i.e., to route forwarded traffic through it), not for management traffic arriving on a directly attached interface. The client attempting to manage the FortiGate needs a correct route back to the FortiGate's IP, but that is a client-side concern, not something configured as a static route on the FortiGate itself.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.