NSE7 Enterprise Firewall and VDOMs Practice Question
A FortiGate administrator runs the following command and sees the output:
diagnose sys session filter dport 443 diagnose sys session list
Output shows sessions with proto=6 and expire time decreasing. What does this indicate?
⚠ Common exam trap
A common mix-up: candidates confuse 'expire time decreasing' with a session being blocked or expiring, when in fact it is a normal indicator of an active TCP session that is being refreshed by traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The sessions are TCP sessions and are active
The command 'diagnose sys session filter dport 443' filters sessions with destination port 443, and 'diagnose sys session list' displays them. The output shows 'proto=6', which is the protocol number for TCP (per IANA protocol numbers). The 'expire time decreasing' indicates that the session timer is counting down, which is normal behavior for an active TCP session that is being refreshed by ongoing traffic. Therefore, the sessions are TCP and active.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The sessions are using UDP protocol
Why it's wrong here
proto=6 identifies TCP, not UDP, so the sessions are TCP and the decreasing expire time simply reflects normal session timeout countdown. Reading proto as a UDP indicator is tempting because UDP is connectionless with short timers, and it would be correct if the output showed proto=17.
- ✗
The FortiGate is performing deep packet inspection on these sessions
Why it's wrong here
Deep packet inspection does not change session expiry behaviour; proto=6 and a decreasing expire timer simply show active TCP sessions ageing normally. It is tempting because port 443 traffic is often inspected, and DPI would be the answer if the output showed proxy or certificate-related session attributes instead.
- ✗
The sessions are being blocked by a firewall policy
Why it's wrong here
Blocked sessions are removed from the session table rather than listed with a decreasing expire timer, which indicates an established, permitted session. It is tempting because port 443 is commonly filtered, and a deny policy would be the answer if the output showed no session entry or a deny log instead.
- ✓
The sessions are TCP sessions and are active
Why this is correct
Proto=6 identifies TCP, and a decreasing expire timer proves the session remains live in the FortiGate session table rather than timing out. This satisfies the stem's constraint: port 443 traffic is being tracked as established, active TCP sessions, confirming normal stateful inspection behaviour.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.