The study guide states:
"FortiGate categorizes an entry in the session table as an ephemeral session when it is a TCP session that is not fully established (three-way handshake not completed), or when it is a UDP session with only one packet received." This directly proves:
A is correct because a UDP session with only one packet received is ephemeral.
C is correct because a TCP session waiting for the SYN/ACK is not fully established, so it is ephemeral. The study guide's TCP state table shows that the handshake is only completed when the session reaches ESTABLISHED Why the other options are wrong:
B is wrong because once UDP traffic has been seen in both directions, it is no longer the "single packet received" condition described for ephemeral sessions. The study guide says for UDP: 00 = one way, 01 = both ways D is wrong because a TCP session waiting for FIN/ACK is already in the closing stage after establishment, not in the "not fully established" stage. The study guide explains that after both sides close the session, FortiGate can keep it briefly in the table in state value 5 for out-of-order packets after FIN/ACK