The answer is to enable SSH administrative access on the interface connected to the management subnet. This is correct because FortiGate interfaces have a dedicated administrative access setting that controls which management protocols—such as SSH, HTTPS, or Ping—are allowed to reach the device itself at Layer 3, before any firewall policy is evaluated. Without this setting enabled, the FortiGate silently drops SSH packets at the interface level, regardless of any firewall rules that might otherwise permit traffic from the 10.0.1.0/24 subnet. On the Fortinet NSE 4 exam, this question tests your understanding of the distinction between interface-level administrative access and policy-based traffic control—a common trap is assuming a firewall policy alone is sufficient for management access. Remember the key rule: management access is controlled at the interface, not by policies. A helpful memory tip is “SSH needs the interface switch”—if you want SSH to reach the box, flip the toggle on the interface itself.
NSE4 System and Network Administration Practice Question
This NSE4 practice question tests your understanding of system and network administration. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A network administrator needs to allow SSH access to the FortiGate from a management subnet 10.0.1.0/24. Which configuration step is required on the interface connected to that subnet?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable SSH administrative access on the interface
Option C is correct because to allow SSH access to the FortiGate from a specific subnet, you must enable SSH administrative access on the interface connected to that subnet. This setting controls which management protocols are permitted to reach the FortiGate itself at the interface level, independent of firewall policies. Without enabling SSH on the interface, the FortiGate will drop SSH packets at Layer 3 before any policy lookup occurs.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
There is no 'any' option; access is per-protocol and must be explicitly enabled.
✓
Enable SSH administrative access on the interface
Why this is correct
SSH must be enabled on the interface for SSH connections to be accepted.
Related concept
Read the scenario before looking for a memorised answer.
✗
Configure a firewall policy allowing SSH from the subnet
Why it's wrong here
Firewall policies are for traffic passing through the FortiGate, not for management access.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume a firewall policy is sufficient to allow management traffic, forgetting that administrative access must be explicitly enabled on the interface for protocols like SSH, HTTPS, or Telnet.
Detailed technical explanation
How to think about this question
FortiGate interfaces have a dedicated 'administrative access' configuration that acts as a pre-filter for management traffic. When SSH is enabled on an interface, the FortiGate's kernel accepts incoming SSH packets destined to its own IP address and forwards them to the management daemon. This is separate from firewall policies, which control traffic passing through the FortiGate, not traffic destined to it. In real-world deployments, failing to enable the correct administrative access protocol is a common cause of lockouts when managing the device remotely.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
System and Network Administration — This question tests System and Network Administration — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Enable SSH administrative access on the interface — Option C is correct because to allow SSH access to the FortiGate from a specific subnet, you must enable SSH administrative access on the interface connected to that subnet. This setting controls which management protocols are permitted to reach the FortiGate itself at the interface level, independent of firewall policies. Without enabling SSH on the interface, the FortiGate will drop SSH packets at Layer 3 before any policy lookup occurs.
What should I do if I get this NSE4 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator needs to allow SSH management access from a specific IP address 10.0.0.100. Which configuration is required?
easy
A.Enable SSH on the WAN interface and allow all IPs
✓ B.Set the trusted host for the admin account to 10.0.0.100
C.Configure an access list on the upstream router
D.Create a firewall policy allowing SSH from 10.0.0.100 to the FortiGate
Why B: Option B is correct because FortiGate uses the 'trusted host' feature to restrict administrative access to specific source IP addresses. By setting the trusted host to 10.0.0.100 for the admin account, only that IP can initiate SSH sessions to the FortiGate management interface, regardless of which interface SSH is enabled on.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.