Advanced Threat Protection →hardMultiple ChoiceObjective-mapped

NSE7 Advanced Threat Protection Practice Question

You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate?

⚠ Common exam trap

Many candidates confuse the proto_state value 01 with SYN_SENT (which is 02) or assume the expire field indicates total session lifetime rather than remaining idle timeout.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The session is an established TCP session with about one hour remaining before timeout

The output shows a TCP session (proto=6) with state 01, which in Fortinet's session table indicates an established TCP connection. The duration of 3600 seconds and expire value of 3599 seconds mean the session has been active for about one hour and has approximately one hour remaining before the idle timeout expires. This matches option B.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The session is in SYN_SENT state and cannot be established
Why it's wrong here
SYN_SENT is state 02; state 01 is established.
✓
The session is an established TCP session with about one hour remaining before timeout
Why this is correct
Established TCP session (state 01), duration 3600s, expire 3599s (about 1 hour).
✗
The session is a UDP session using port 443
Why it's wrong here
proto=6 indicates TCP (6), not UDP (17).
✗
The session has a duration of 3600 seconds and will expire immediately
Why it's wrong here
Expire=3599 means it expires in 3599 seconds, not immediately.

Visual reference

Go deeper

NSE7 Advanced Threat Protection Practice Question

Why each option matters

Option-by-option breakdown

Related to this question