During the packet flow process, which two processes are performed in application identification? (Choose two.)

Pattern-based application identification is a core mechanism where the firewall uses signatures and heuristics to detect and classify applications based on known patterns in the traffic.

An application override policy allows an administrator to explicitly define an application for specific traffic flows, bypassing standard application identification and forcing a particular application classification.

Application identification typically occurs *before* content inspection. While content inspection (e.g., Threat Prevention) might refine or confirm an application, the initial identification doesn't usually *change* from it in the sequence described.

The 'Session application identified' is an *outcome* or *result* of the application identification process, not a process step itself.