NSE7 Enterprise Firewall and VDOMs Practice Question
An administrator runs 'diagnose sys session filter dport 443' and sees 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate?
⚠ Common exam trap
Candidates often misinterpret proto_state values or confuse duration with idle time. Here, proto_state=01 suggests SYN_SENT, but the long duration indicates an established session, meaning none of the provided options are correct.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The session is in TCP SYN_SENT state
The output shows proto=6 (TCP) and proto_state=01 (SYN_SENT). However, a session with a duration of 3600 seconds cannot remain in SYN_SENT state; it would have timed out or transitioned to ESTABLISHED. Therefore, the output is contradictory and none of the provided options correctly describe the session. Option A is wrong because proto=6 is TCP, not UDP. Option B is wrong because a session alive for an hour cannot be in SYN_SENT. Option C is wrong because 'expire' is in seconds, not milliseconds. Option D is wrong because 'duration' is the total session time, not idle time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The session is a UDP flow
Why it's wrong here
Protocol 6 is TCP, not UDP. Wrong.
- ✓
The session is in TCP SYN_SENT state
Why this is correct
proto_state=01 is SYN_SENT, but the long duration indicates an established session. The actual state is ESTABLISHED (not listed). So B is incorrect.
- ✗
The session will expire in 3599 milliseconds
Why it's wrong here
expire value is in seconds, not milliseconds. Wrong.
- ✗
The session has been idle for 3600 seconds
Why it's wrong here
duration is total session lifetime (3600s), not idle time. Wrong.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.