Palo Alto Networks Certified Network Security Engineer (PCNSE) — Question 217

What are three reasons why an installed session can be identified with the "application incomplete" tag? (Choose three.)

Answer options

• A. There was no application data after the TCP connection was established.
• B. The client sent a TCP segment with the PUSH flag set.
• C. The TCP connection was terminated without identifying any application data.
• D. There is not enough application data after the TCP connection was established.
• E. The TCP connection did not fully establish.

Correct answer: A, C, E

Explanation

The correct answers A, C, and E indicate scenarios where insufficient or no application data is present following the TCP connection. Option A suggests a complete lack of data, C describes an incomplete termination without data, and E points to a failure in establishing the connection. Option B is incorrect because sending a TCP segment with the PUSH flag does not indicate an incomplete application session.