FCP-FGT-AD - Deployment and system configuration (20% of the exam) - Section 1.1

Perform initial FortiGate configuration including interface setup, administrative access, and basic network settings.

Configure FortiGate interface addresses, administrative access methods such as HTTPS and SSH, and basic network settings using the GUI and CLI. Recognise which settings must be in place before the device can pass traffic and be managed securely.

FortiGate initial setupadministrative accessFortiOS interface configuration

Practice question for this objective

Free sampleDeployment and system configurationeasy

During initial configuration an administrator must manage a FortiGate internal interface using only encrypted protocols, so that both the web GUI and the command-line interface are reachable while no credentials ever cross the wire in clear text. Which two protocols should be added to the interface allowaccess list to meet this requirement? Select TWO.

AHTTP, so the administrator can reach the web-based GUI from a standard browser without certificate prompts.
BHTTPS, so the administrator can reach the web-based GUI over a TLS-encrypted management session. Correct
CTelnet, so the administrator can open a remote command-line session to the FortiGate over the network.
DSSH, so the administrator can open a remote command-line session to the FortiGate over an encrypted channel. Correct
EPING, so the administrator can confirm reachability to the interface before logging in to manage it.

Encrypted management of a FortiGate interface uses HTTPS for the GUI and SSH for the CLI, both added to the interface allowaccess list. The allowaccess list on a FortiGate interface controls which management services answer on that interface. HTTPS terminates the GUI over TLS and SSH terminates the CLI over an encrypted transport, so enabling that pair keeps credentials and session data confidential, whereas HTTP and Telnet are their unencrypted equivalents and PING offers no management at all.

Why A is wrong: HTTP does reach the GUI, but it carries the management session and credentials in clear text, which violates the encrypted-only requirement.

Why B is correct: HTTPS provides GUI access over TLS, so credentials and session data are encrypted in transit as required.

Why C is wrong: Telnet reaches the CLI but transmits the session, including the password, as clear text, so it fails the encryption requirement.

Why D is correct: SSH provides CLI access over an encrypted channel, meeting the requirement for command-line management without clear-text credentials.

Why E is wrong: PING only permits ICMP echo for reachability testing and provides no management plane, so it neither offers GUI nor CLI access.

See more FCP-FGT-AD practice questions, answers explained.

Exam traps in Deployment and system configuration

Answers that look right on this material and are not. Each one is a distractor from a different question in the FCP-FGT-AD bank for this domain.

Remove HTTPS and SSH, keeping HTTP and Telnet, because those are the lightweight management protocols.
Why it is wrong: This inverts the requirement: HTTP and Telnet transmit credentials in clear text, so keeping them while dropping the encrypted protocols increases exposure rather than hardening the interface.
The interface role, which must be set to LAN before any management traffic is accepted.
Why it is wrong: The interface role is a label that adjusts which fields the GUI shows and helps organise policies; it does not gate management access, so changing it is not what allows the GUI session.
HTTPS administrative access cannot be used over a direct cable connection, so the administrator must enable Telnet on the interface and connect over HTTP instead.
Why it is wrong: Tempting because protocol settings matter, but HTTPS works fine over a direct cable; the failure is Layer 3 addressing, and Telnet is an unencrypted CLI protocol that would not serve the GUI anyway, so this is wrong.

Examworthy is not affiliated with or endorsed by Fortinet. Original, blueprint-aligned practice material only.