Quick Answer
The answer is that traffic is being fast-forwarded without security profile inspection. This is indicated because the 'fnbam sctp state' entries in the debug output confirm the session is offloaded to the NPU for hardware acceleration via the SCTP fast-path, which is the normal behavior for flow-based inspection when traffic meets fast-forwarding criteria. On the Fortinet NSE 7 Advanced Security NSE7 exam, this question tests your understanding of NPU offload mechanics versus protocol inspection—a common trap is mistaking 'sctp' for the SCTP transport protocol or an attack signature. Remember the memory tip: SCTP in fnbam stands for Session Control Traffic Path, not Stream Control Transmission Protocol; if you see it, think "skip the inspection, straight to the chip."
This NSE7 practice question tests your understanding of enterprise firewall and vdoms. Examine the command output carefully: the correct answer depends on what the output actually shows, not on general recall alone. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An administrator runs 'diagnose debug application fnbam 3' and sees many entries with state 'sctp'. The FortiGate has flow-based inspection enabled. What is being indicated?
Traffic is being fast-forwarded without security profile inspection
fnbam entries with 'sctp' indicate sessions that bypass full scanning.
The FortiGate is performing SCTP deep inspection
Why wrong: SCTP deep inspection is not shown by fnbam.
The FortiGate is using proxy-based inspection
Why wrong: Proxy-based inspection would not show fnbam entries.
There is an SCTP-based attack in progress
Why wrong: fnbam is not an attack detection tool.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Traffic is being fast-forwarded without security profile inspection
The 'diagnose debug application fnbam 3' command shows the FortiGate's flow-based Network Processor (NPU) session offload status. When entries show state 'sctp', it indicates that the traffic is being handled by the SCTP (Session Control Traffic Path) fast-path, meaning the session is offloaded to the NPU for hardware acceleration and bypasses security profile inspection. This is normal for flow-based inspection when traffic matches fast-path criteria, not an indication of SCTP protocol inspection or attacks.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Traffic is being fast-forwarded without security profile inspection
Why this is correct
fnbam entries with 'sctp' indicate sessions that bypass full scanning.
Related concept
Read the scenario before looking for a memorised answer.
The FortiGate is performing SCTP deep inspection
Why it's wrong here
SCTP deep inspection is not shown by fnbam.
The FortiGate is using proxy-based inspection
Why it's wrong here
Proxy-based inspection would not show fnbam entries.
There is an SCTP-based attack in progress
Why it's wrong here
fnbam is not an attack detection tool.
Common exam traps
The trap here is that candidates see 'sctp' and immediately think of the Stream Control Transmission Protocol (SCTP) rather than recognizing it as a FortiGate-specific acronym for 'Session Control Traffic Path' in the NPU offload context.
Trap categories for this question
Command / output trap
SCTP deep inspection is not shown by fnbam.
Detailed technical explanation
The fnbam (Flow-Based Application Module) debug output shows session offload status to the NP6/NP7 processors. The 'sctp' state specifically means the session is handled by the SCTP fast-path engine, which is a hardware-accelerated path for sessions that do not require full security inspection. This offloading is critical for high-throughput environments like data centers, where tens of thousands of sessions must be processed without CPU intervention, but it means those sessions skip application control, IPS, and antivirus inspection.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Enterprise Firewall and VDOMs — study guide chapter
Learn the concepts, then practise the questions
Enterprise Firewall and VDOMs practice questions
Targeted practice on this topic area only
All NSE7 questions
1,000 questions across all exam domains
Fortinet NSE 7 Advanced Security NSE7 study guide
Full concept coverage aligned to exam objectives
NSE7 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise NSE7 questions linked to Advanced Networking and SD-WAN.
Practise NSE7 questions linked to Advanced VPN and Zero Trust.
Practise NSE7 questions linked to Enterprise Firewall and VDOMs.
Practise NSE7 questions linked to Advanced Threat Protection.
Practise NSE7 questions linked to Troubleshooting and Diagnostics.
Practise NSE7 questions linked to NSE7 fundamentals.
Practise NSE7 questions linked to NSE7 scenario.
Practise NSE7 questions linked to NSE7 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Enterprise Firewall and VDOMs — This question tests Enterprise Firewall and VDOMs — Read the scenario before looking for a memorised answer..
The correct answer is: Traffic is being fast-forwarded without security profile inspection — The 'diagnose debug application fnbam 3' command shows the FortiGate's flow-based Network Processor (NPU) session offload status. When entries show state 'sctp', it indicates that the traffic is being handled by the SCTP (Session Control Traffic Path) fast-path, meaning the session is offloaded to the NPU for hardware acceleration and bypasses security profile inspection. This is normal for flow-based inspection when traffic matches fast-path criteria, not an indication of SCTP protocol inspection or attacks.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 24, 2026
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.