While analyzing the Traffic log, you see that some entries show "unknown-tcp" in the Application column What best explains these occurrences?

The correct answer is C. A handshake did take place, but the application could not be identified. Unknown-tcp means the firewall captured the three-way TCP handshake, but the application was not identified. This may be due to the use of a custom application for which the firewall does not have signatures…

Submitted by rohit_dlh· Apr 18, 2026Operate

Question

Options

AA handshake took place, but no data packets were sent prior to the timeout.
BA handshake took place; however, there were not enough packets to identify the application.
CA handshake did take place, but the application could not be identified.
DA handshake did not take place, and the application could not be identified.

How the community answered

(40 responses)

A
3% (1)
B
5% (2)
C
93% (37)

Explanation

Unknown-tcp means the firewall captured the three-way TCP handshake, but the application was not identified. This may be due to the use of a custom application for which the firewall does not have signatures. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClibCAC#:~:text =unknown%2Dtcp%3A,firewall%20does%20not%20have%20signatures.

Topics

#App-ID#Traffic Logs#Application Classification#Session Flow

Community Discussion

No community discussion yet for this question.

Full PCNSE Practice