When does a RADIUS server send an Access-Challenge packet?

A FortiGate’s port1 is connected to a private network. Its port2 is connected to the Internet. Explicit web proxy is enabled in port1 and only explicit web proxy
users can access the Internet. Web cache is NOT enabled. An internal web proxy user is downloading a file from the Internet via HTTP. Which statements are true
regarding the two entries in the FortiGate session table related with this traffic? (Choose two.)

Examine the output from the ‘diagnose debug authd fsso list’ command; then answer the question below.
# diagnose debug authd fsso list
—-FSSO logons—-
IP: 192.168.3.1 User: STUDENT Groups: TRAININGAD/USERS Workstation: INTERNAL2. TRAINING. LAB
The IP address 192.168.3.1 is NOT the one used by the workstation INTERNAL2. TRAINING. LAB.
What should the administrator check?

Examine the output of the ‘diagnose debug rating’ command shown in the exhibit; then answer the question below.
Which statement are true regarding the output in the exhibit? (Choose two.)

Examine the output of the ‘diagnose sys session list expectation’ command shown in the exhibit; then answer the question below.
Which statement is true regarding the session in the exhibit?