Exam PCNSE topic 1 question 259 discussion

There is a lack of available documentation for this CLI command. I think the answer is ADE Cannot be B because session is still active, hence reason "unknown" I don't think it can be C because "session proxied" is true which I've only seen when SSL Decryption is being performed - regular HTTP traffic does not show this flag

ADE is correct. Session is still active, hence 'unknown' end reason, as mentioned correctly by Shenanigans123.

session still active, proxied == decrypted

Due to port and protocol decoders, session will be identified as SSL, therefore A is correct. Session state shows as "active" therefore, B is incorrect. The output of the command shows "... proxied = no", therefore C is correct (although crappy spelling). The session shows URL Category identified, therefore, after SSL and more payload, the app-id was web-browsing, therefore, D is correct. The output of the command shows "... proxied = no", therefore E is incorrect.

Correct answers: ADE

I perform this in lab.

Answers are A, D, E.

Got his question in December 2023 only good two choices to answer. selected D and E as others already stated end-reason "unkown" is misleading look at the state = ACTIVE session table = actual sessions

ADE is the correct option

Session Proxied : Yes means session is ssl decrypted Before decryption identified as ssl and after decryption identified as web browsing

when I had this question, it only asked for 2 things.

How do you know from this info that the session was decrypted? You can infer it from the question by a process of elimination, B&C are wrong

the sh session command only shows active sessions, can't be B

ADE. The fact that the session is still active, it can't be B.

ADE is correct. As the initial traffic is on port 443 and after that application shift occurs and the session is still active.

Should be ADE. "end reason: unknown" will show for all "ACTIVE" sessions. So B is not correct.

With the destination port being 443 and the application being web-browsing, that means that this was decrypted. The session clearly says it ended as unknown.