NSE4 Session duration Practice Question
An administrator runs the following CLI command and sees the output: 'diagnose sys session list | grep -A 5 10.1.1.100' and finds a session with 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate about the session?
⚠ Common exam trap
Common mistake: Candidates think 'duration' is the timeout value, but in Fortinet's 'diagnose sys session list', 'duration' is the elapsed time since the session started, and 'expire' is the remaining time. The timeout is the sum of duration and expire (if not zero), but here duration is directly the age.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The session has been active for 3600 seconds
The 'duration' field in Fortinet session output indicates the actual time the session has been alive (session age), while 'expire' indicates the remaining time before timeout. Here, duration=3600 means the session has been active for 3600 seconds (1 hour). expire=3599 is just slightly less than the duration, but the key is that duration is the age. Therefore, option C is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The session is about to expire
Why it's wrong here
The 'expire' field displays the remaining time in seconds before the session is torn down; a value of 3599 means 3599 seconds (roughly one hour) remain, so the session is fresh, not imminently expiring. A session would be 'about to expire' only if the expire value were near zero or the session were in an idle timeout state, neither of which is the case here.
- ✗
The session has been active for approximately 1 second
Why it's wrong here
The 'duration' field is the timestamp in seconds since the session was first established; it increments sequentially as the session lives. Here duration=3600, which means the session is exactly one hour old, not one second old. The value '1' might be misfed from the protocol number or a misread, but duration is unambiguous.
- ✓
The session has been active for 3600 seconds
Why this is correct
The 'duration' field in Fortinet's session output records the age of the session in seconds, counting upward from the moment the connection was first seen. In this output, duration=3600 directly indicates the session has been active for exactly 3600 seconds (one hour). This is the only option that matches the literal value in the CLI output.
- ✗
The session is using UDP protocol
Why it's wrong here
The 'proto' field uses standard IANA protocol numbers: TCP is 6, UDP is 17. Since the output shows proto=6, the session is using TCP, not UDP. UDP, typically associated with DNS or VoIP, would appear as proto=17, so this session cannot be UDP.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.