NSE7 Enterprise Firewall and VDOMs Practice Question
A FortiGate administrator runs the following command and sees the output:
diagnose sys session filter dport 443 diagnose sys session list
Output shows sessions with proto=6 and expire time decreasing. What does this indicate?
⚠ Common exam trap
A common mix-up: candidates confuse 'expire time decreasing' with a session being blocked or expiring, when in fact it is a normal indicator of an active TCP session that is being refreshed by traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The sessions are TCP sessions and are active
The command 'diagnose sys session filter dport 443' filters sessions with destination port 443, and 'diagnose sys session list' displays them. The output shows 'proto=6', which is the protocol number for TCP (per IANA protocol numbers). The 'expire time decreasing' indicates that the session timer is counting down, which is normal behavior for an active TCP session that is being refreshed by ongoing traffic. Therefore, the sessions are TCP and active.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The sessions are using UDP protocol
Why it's wrong here
proto=6 is TCP, not UDP.
- ✗
The FortiGate is performing deep packet inspection on these sessions
Why it's wrong here
The output does not indicate inspection; it only shows session details.
- ✗
The sessions are being blocked by a firewall policy
Why it's wrong here
Blocked sessions would not appear in the session list.
- ✓
The sessions are TCP sessions and are active
Why this is correct
proto=6 indicates TCP. The sessions are listed, meaning they are active and being tracked.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.