NSE4 Security Profiles Practice Question
An admin runs the following command on a FortiGate: 'diagnose sys session filter dport 443' and sees output: 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate?
⚠ Common exam trap
Watch out — candidates often assume 'duration=3600' means the session has been active for an hour and thus must be established, but the proto_state field (01) overrides that assumption by indicating the session is still in the SYN_SENT phase of the TCP handshake.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The session is in the SYN_SENT state and is not yet fully established
The output shows 'proto=6' (TCP), 'proto_state=01', 'duration=3600', and 'expire=3599'. In FortiGate's session table, proto_state=01 for TCP indicates the SYN_SENT state, meaning the session has sent a SYN but has not yet received the SYN-ACK. This confirms the session is not fully established. Option B correctly identifies this as a half-open session in the SYN_SENT state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The session is stuck in a half-open state due to a firewall policy misconfiguration
Why it's wrong here
The session is not 'stuck' in a half-open state due to a firewall policy misconfiguration. proto_state=01 (SYN_SENT) is a normal transient state during TCP connection establishment, and a single diagnostic snapshot cannot imply a policy fault. A policy misconfiguration would typically manifest as repeated SYNs or denied packets, not a stable SYN_SENT entry. This state simply indicates the client's SYN was sent and no reply has been processed yet.
- ✓
The session is in the SYN_SENT state and is not yet fully established
Why this is correct
In FortiGate session output, proto_state=01 maps to TCP SYN_SENT in the TCP state machine. This means the session originated with a SYN packet and is currently awaiting a SYN-ACK from the server; the three-way handshake has not yet completed. Therefore, the session is not fully established and should not be treated as an active, fully formed session. This is the correct interpretation of the diagnostic data.
- ✗
The session is fully established and has been active for 3600 seconds
Why it's wrong here
A fully established TCP session would be indicated by proto_state=05, which corresponds to TCP ESTABLISHED in FortiGate's session table. The value 01 clearly indicates SYN_SENT, not ESTABLISHED, regardless of any elapsed time field such as 3600 seconds. The session duration does not influence the protocol state; the state field is authoritative for the TCP connection phase. Thus, this session is not fully established.
- ✗
The session is using UDP protocol
Why it's wrong here
The proto field in FortiGate diagnostics uses IP protocol numbers: 6 indicates TCP, while UDP uses protocol number 17. Since the output shows proto=6, the session is unequivocally a TCP session. UDP sessions would show proto=17 and typically do not carry a TCP-style proto_state value. Therefore, interpreting this session as UDP is incorrect.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.