Exam NSE4_FGT-6.4 All Questions

View all questions & answers for the NSE4_FGT-6.4 exam

Exam NSE4_FGT-6.4 topic 1 question 79 discussion

Actual exam question from Fortinet's NSE4_FGT-6.4

Question #: 79
Topic #: 1

Refer to the exhibit, which contains a session diagnostic output.

Which statement is true about the session diagnostic output?

A. The session is in ESTABLISHED state
B. The session is in SYN_SENT state
C. The session is in FIN_ACK state
D. The session is in FIN_WAIT state

Show Suggested Answer

Suggested Answer: B 🗳️

by phototrait at June 30, 2021, 6:57 p.m.

Comments

Submit Cancel

phototrait

Highly Voted 4 years, 1 month ago

B is correct. FortiGate_Security_6.4 page 182 proto=6tcp/proto_state=02 SYN_SENT

upvoted 19 times

...

The correct answer: B In the first line "Session info: proto=6 proto_state=02" Indicates TCP (proto=6) session in SYN_SENT state (proto=state=2) https://kb.fortinet.com/kb/viewContent.do?externalId=FD30042

upvoted 8 times

...

Ibrahimadwan

Most Recent 2 years, 2 months ago

B is correct

upvoted 1 times

...

learner_88

2 years, 9 months ago

Selected Answer: B

B 100%

upvoted 1 times

...

johnnd

2 years, 11 months ago

Selected Answer: B

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-FortiGate-session-table-information/ta-p/196988#:~:text=the%20Reply%20direction-,State,-Value

upvoted 1 times

...

jmanning

2 years, 11 months ago

Selected Answer: B

brld explained it correctly

upvoted 1 times

...

PascalCert

3 years ago

Selected Answer: B

B is correct. FortiGate_Security_7.0 page 191. 0=None 1=Established 2=Syn_Sent

upvoted 3 times

...

Goshler

3 years ago

Selected Answer: B

It´s B.

upvoted 2 times

...

Bluey

3 years ago

Selected Answer: A

So this is A to me. Yes, proto_state=02 =SYN_SENT. However, with SYN_SENT, there's no 3-way handshake yet. In this evidence, we see traffic being sent and received, which doesn't work with SYN_SENT. Additionally, the expire timer is 3600s, which is default for ESTABLISHED. SYN_SENT has a default timer of 120s and it makes to sense to increase this. Looks like a weirdly cobbled together output, but SYN_SENT zooms in on 1 piece of evidence while ignoring everything that contradicts it.

upvoted 3 times

...