The grid-operations NOC's security team is hardening the FortiGate interface that faces the wide-area link to remote substations. They want administrators to still be able to reach the interface for management, but only over encrypted protocols, with legacy plaintext management protocols disabled. Which administrative access combination best fits that goal?

Each FortiGate interface has an independent administrative-access setting that controls which protocols are permitted for management traffic terminating on that interface, and the secure choices for GUI and CLI access are HTTPS and SSH respectively, since both encrypt the session end to end. Restricting a WAN-facing interface to just those two closes off the interface to anything that doesn't need encrypted management. Enabling HTTP, Telnet, and SSH together fails the requirement outright because HTTP and Telnet both transmit credentials and session data in plaintext, which is exactly the exposure the NOC is trying to eliminate on a link that traverses the wide area to remote substations. Enabling only PING is not a management-access answer at all — PING allows the interface to respond to ICMP echo requests for reachability testing, but it carries no administrative session capability whatsoever, so administrators still couldn't log in. Adding SNMP alongside HTTPS and HTTP does not solve the problem either, since SNMP is a monitoring protocol, not a login protocol, and leaving HTTP enabled still exposes plaintext GUI sessions. To confirm the hardening took effect, check the interface's administrative access settings and attempt an HTTP connection from an external host — it should be refused.