NSE7 Advanced Threat Protection Practice Question
An administrator runs 'diagnose sys session filter dport 443' and sees the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?
⚠ Common exam trap
The trap here is that candidates may misinterpret 'proto=6' as a generic protocol number without recalling that protocol 6 is specifically TCP, leading them to incorrectly associate the output with UDP-based services like DNS or SSL VPN tunnels.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The session is a TCP connection that has been active for 3600 seconds and will expire in 3599 seconds
The output shows 'proto=6' which indicates TCP (protocol 6), 'duration=3600' means the session has been active for 3600 seconds (1 hour), and 'expire=3599' means the session will expire in 3599 seconds. The 'proto_state=01' is a TCP state code indicating an established connection. This is a standard FortiGate diagnostic session output.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The session is a TCP connection that has been active for 3600 seconds and will expire in 3599 seconds
Why this is correct
Correct interpretation of fields.
- ✗
The session is a UDP DNS request
Why it's wrong here
proto=6 is TCP, not UDP.
- ✗
The session is being blocked by a firewall policy
Why it's wrong here
The output shows an active session, not a blocked one.
- ✗
The session is an SSL VPN tunnel
Why it's wrong here
No indication of VPN in the output.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.