NSE4 System and Network Administration Practice Question
An administrator needs to allow SSH access to the FortiGate's management interface from a specific management subnet (10.0.1.0/24). Which configuration achieves this?
⚠ Common exam trap
It's easy for candidates to confuse firewall policies (which control transit traffic) with administrative access controls (which control traffic destined to the FortiGate itself), leading them to incorrectly select Option B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Under system admin settings, set the trusted host for the administrator to 10.0.1.0/24 and enable SSH access
The trusted host setting under system admin settings restricts administrative access (including SSH) to only the specified source IP or subnet. By setting the trusted host to 10.0.1.0/24 and enabling SSH access, the FortiGate ensures that only SSH connections originating from that management subnet can reach the management interface. This is the standard method for controlling administrative access to the FortiGate's management plane.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the administrative access profile to allow SSH from any IP
Why it's wrong here
Choosing this option would permit SSH administrative sessions from any source IP, completely bypassing the requirement to restrict access to the 10.0.1.0/24 management subnet. Administrative access profiles on an interface only enable a protocol like SSH; they do not filter source addresses. To enforce a source restriction, you must combine the SSH setting with trusted hosts configured for the administrator, so this option is overly permissive and fails the security goal.
- ✗
Configure a firewall policy to allow SSH from 10.0.1.0/24 to the FortiGate
Why it's wrong here
Firewall policies govern traffic that transits the FortiGate from one interface to another (e.g., internal to internet), not traffic destined to the FortiGate's own management IP. SSH to the FortiGate is management-plane traffic and is instead controlled by administrative access settings on the interface and trusted hosts assigned to the administrator. Even if the policy matched 10.0.1.0/24 to the FortiGate, it would not be evaluated for locally destined traffic in standard configurations, so it would not enable SSH access.
- ✓
Under system admin settings, set the trusted host for the administrator to 10.0.1.0/24 and enable SSH access
Why this is correct
This is the standard and correct method: in the System > Admin > Administrators settings, define a trusted host as 10.0.1.0/24 for that administrator, and ensure SSH is enabled in the administrative access for the interface the admin connects to. Trusted hosts explicitly allowlist the source IP ranges that can initiate management sessions, so only devices from 10.0.1.0/24 can SSH to the FortiGate. Additionally, SSH administrative access must be enabled on the relevant interface for the login to be accepted.
- ✗
Create a local-in policy to allow SSH from 10.0.1.0/24
Why it's wrong here
Local-in policies are an advanced mechanism that can filter traffic destined to the FortiGate, but they do not replace the need for administrative access and trusted hosts. Creating a local-in policy to allow SSH from 10.0.1.0/24 still requires SSH to be enabled on the interface and does not inherently restrict administration to that subnet if trusted hosts are not set. Moreover, local-in policies are typically used for selective packet handling and can be complex; they are not the standard or sufficient method for restricting management access.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.