An automation team at the NOC uses scripted CLI sessions to push configuration changes to the FortiGate on its internal management interface, and never uses the web GUI on that interface. The security team wants to reduce the interface's attack surface to only what the automation actually uses. Which change accomplishes that?

Since the stated usage is exclusively scripted CLI sessions and the GUI is never used on this interface, disabling HTTPS and HTTP while retaining SSH removes two listening management protocols that serve no purpose here, directly reducing the interface's attack surface to match actual usage — this follows the same least-access principle applied earlier to hardening interfaces for only what they need. Leaving all three protocols enabled in case the GUI is needed later keeps unused attack surface open indefinitely against a speculative future need, which is the opposite of minimizing exposure now. Disabling SSH and leaving only HTTP would remove the very protocol the automation team depends on while replacing it with an unencrypted GUI protocol that transmits credentials and commands in plaintext — worse on both counts. Disabling every administrative protocol, including SSH, would also disable the automation team's actual working access method, breaking the scripted configuration pushes entirely rather than merely tightening the surface around them. To verify the change, confirm the automation team's scripted SSH sessions continue to succeed while an HTTPS or HTTP connection attempt to that interface is refused.