NSE4 Authentication and VPN Practice Question
You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate?
⚠ Common exam trap
Many candidates confuse `duration` with idle time or assume `proto_state=01` means an established session, when in fact it specifically indicates the SYN_SENT phase of the TCP three-way handshake.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The session is in SYN_SENT state and might be stuck due to no response from the server.
The output shows `proto_state=01`, which in Fortinet's session table corresponds to the TCP SYN_SENT state (the session is waiting for a SYN-ACK from the server). The `duration=3600` indicates the session has existed for 3600 seconds, but the `expire=3599` shows it has not yet been confirmed as established. This combination indicates the session is stuck in the SYN_SENT state, likely because the server is not responding, making option B correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The session is fully established and has been active for 3600 seconds.
Why it's wrong here
The hexadecimal state value '01' in the diagnose sys session output is the TCP SYN_SENT state, not an established session. Fortinet represents fully established sessions with state codes such as '09' or '0a', and a session in state 01 has never completed the three-way handshake, so it cannot be 'fully established' despite the 3600-second duration.
- ✓
The session is in SYN_SENT state and might be stuck due to no response from the server.
Why this is correct
State 01 explicitly maps to TCP SYN_SENT, which means the firewall sent a SYN packet and is waiting for a SYN-ACK from the destination server. A duration of 3600 seconds with no state transition indicates the server has not responded, so the session is likely stuck in the initiation phase and will eventually time out unless the missing SYN-ACK appears.
- ✗
The session has been idle for 3599 seconds and will expire soon.
Why it's wrong here
The 'expire' field in the diagnose sys session output is a countdown timer that decrements until the session is purged from the session table, not a measurement of idle time. A value of 3599 seconds means the session still has close to an hour before timing out, so it is not expiring soon, and the state code 01 shows the session is in SYN_SENT, not an idle established connection.
- ✗
The session is in FIN_WAIT state and is being closed.
Why it's wrong here
TCP FIN_WAIT states are represented by different hex codes, such as '03' for FIN_WAIT, and occur during connection teardown after an established connection has exchanged FIN packets. Since the output shows state '01', the session is still in SYN_SENT and has never reached the established state, so it cannot be in the process of closing a connection.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.