Question 386 of 940
NSE7 Troubleshooting and Diagnostics Practice Question
You execute 'diagnose sys session filter dport 443' and see output: 'proto=6 proto_state=01 duration=3600 expire=3599'. What does 'proto_state=01' indicate about this session?
⚠ Common exam trap
Trap: Candidates may misinterpret '01' as the ESTABLISHED state (common TCP state 1 in other contexts) but FortiOS maps TCP state 1 to SYN_SENT, not ESTABLISHED (state 3). The correct TCP state is SYN_SENT (waiting for SYN-ACK).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The session is in the SYN_SENT state, waiting for SYN-ACK
In Fortinet's FortiOS, the 'proto_state' field in session diagnostic output represents the TCP state machine. A value of '01' corresponds to the SYN_SENT state (TCP state 1), indicating that the session has sent a SYN packet and is waiting for a SYN-ACK response. This is consistent with the initial phase of a TCP three-way handshake.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The session is in the SYN_SENT state, waiting for SYN-ACK
Why this is correct
Correct. State '01' in FortiOS maps to TCP state SYN_SENT (waiting for SYN-ACK).
- ✗
The session is in the FIN_WAIT state
Why it's wrong here
Incorrect. FIN_WAIT states are represented by values like 09 (FIN_WAIT_1) or 0A (FIN_WAIT_2), not 01.
- ✗
The session has completed the three-way handshake
Why it's wrong here
Incorrect. A completed three-way handshake would show proto_state=03 (ESTABLISHED), not 01.
- ✗
The session has been terminated with a RST
Why it's wrong here
Incorrect. RST termination would show a different state, such as 06 (CLOSE_WAIT) or 04 (LAST_ACK), not 01.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jul 4, 2026
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.