NSE 4 – WAN Interface Role and Ping Option

I think it’s mis- or over-statement. But it might have changed with 8.0. At least with 7.4 I have the GUI still shows admin access settings.
In any case, regardless “wan” or “lan” role setting, you can still configure everything in CLI. So it wouldn’t “mitigate the risk” anyway, it would only minimize “accidents” or “errors”.

Toshi

Yes, I have seen the same behavior.

In current FortiOS versions, setting the interface role to WAN does not remove the ping option from administrative access. The interface role mainly affects how the GUI presents certain interface-related settings, while administrative access is controlled separately through “allowaccess”

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/574723/interface-settings

For example, it is perfectly valid to have:

config system interface

edit "wan1"

set role wan

set allowaccess ping

next

end

So, based on the actual fortios behavior and the current administration guide, that statement in the study guide appears to be outdated or simply inaccurate.

I would consider the lab behavior you are seeing as expected. Just keep in mind that, for certification purposes, exam questions may still be based on the wording used in the official training material.