NSE7 TCP State Transition Practice Question
A FortiGate administrator is troubleshooting slow network performance. The administrator runs the command 'diagnose sys session filter dst 10.0.0.1' and sees many sessions in a 'proto_state=0a' state. What does this state indicate?
⚠ Common exam trap
Candidates may assume that the hex value 0x0a corresponds to TIME_WAIT or other states, but it specifically indicates FIN_WAIT_2. Confusing the hexadecimal value with decimal or misremembering the state mapping is a common pitfall.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The session is in FIN_WAIT_2 state
In FortiOS session diagnostics, the 'proto_state' field displays a hexadecimal value representing the TCP state. The value 0x0a (decimal 10) corresponds to the TCP FIN_WAIT_2 state. TIME_WAIT corresponds to 0x0b, not 0x0a. Therefore, the session is in FIN_WAIT_2 state. An excessive number of sessions in FIN_WAIT_2 may indicate that remote peers are not properly closing connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The session has been reset
Why it's wrong here
Incorrect. A reset session is indicated by a different state (e.g., CLOSE or RST), not by proto_state=0a.
- ✓
The session is in FIN_WAIT_2 state
Why this is correct
Correct. proto_state=0x0a (decimal 10) maps to TCP FIN_WAIT_2 state, a normal part of TCP teardown.
- ✗
The session is in TIME_WAIT state
Why it's wrong here
Incorrect. TIME_WAIT corresponds to proto_state 0x0b, not 0x0a. 0x0a is specifically FIN_WAIT_2.
- ✗
The session is actively transferring data
Why it's wrong here
Incorrect. Active data transfer is indicated by the ESTABLISHED state (0x01), not by 0a.
- ✗
The session is in SYN_RECEIVED state
Why it's wrong here
Incorrect. SYN_RECEIVED is a state during connection establishment (0x05), not during teardown.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.