The utility's security policy states that a particular administrator account should only ever be able to log in to the FortiGate from workstations inside the NOC's management subnet, even if the correct password is entered from anywhere else. Which FortiGate feature enforces this on the account itself?

Trusted hosts are configured directly on an administrator account and restrict the source IP addresses or subnets from which that account is permitted to authenticate, regardless of whether the submitted credentials are correct — a login attempt from any address outside the configured range is rejected before authentication even completes. That is precisely the source-restriction behavior the utility's policy calls for. A short session timeout only shortens how long an already-authenticated session stays active; it does nothing to stop a login attempt from an unauthorized location in the first place. Placing the management subnet in its own firewall zone affects how traffic is matched by firewall policies between zones, but it does not by itself restrict where a named administrator account can authenticate from — a zone is a traffic-routing and policy construct, not an account-level access control. A read-only access profile limits what an authenticated account can do once logged in; it has no bearing on where the login attempt is allowed to originate. To verify the control is working, attempt to log in to that account from a workstation outside the NOC subnet with the correct password and confirm the FortiGate rejects the attempt.