NSE7 Advanced Networking and SD-WAN Practice Question
You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?
⚠ Common exam trap
Many exam-takers confuse 'proto=6' with UDP or misinterpret 'proto_state=01' as a timeout indicator, when in fact it specifically denotes an established TCP session with a standard 1-hour idle timeout.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The session is a TCP session in established state that has been active for 1 hour and will expire in about 1 hour.
The output shows 'proto=6', which is the protocol number for TCP, and 'proto_state=01', which indicates the TCP session is in an established state (TCP_ESTABLISHED). The 'duration=3600' means the session has been active for 3600 seconds (1 hour), and 'expire=3599' means the session will expire in 3599 seconds (approximately 1 hour), consistent with the default TCP session timeout of 3600 seconds in FortiGate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The session is a UDP session with a short timeout.
Why it's wrong here
Proto=6 is TCP.
- ✗
The session is a UDP session that has been active for 1 hour.
Why it's wrong here
Proto=6 is TCP, not UDP.
- ✓
The session is a TCP session in established state that has been active for 1 hour and will expire in about 1 hour.
Why this is correct
The output matches a TCP established session with durations.
- ✗
The session is a TCP session that has timed out and is being removed.
Why it's wrong here
expire=3599 indicates time left, not timeout.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.