An engineer has been tasked with reviewing traffic logs to find applications the firewall is unable to identify with App-ID. Why would the application field display as incomplete?

The correct answer is D. The TCP connection did not fully establish. "Incomplete" is displayed in the application field if the three-way TCP handshake did not "Incomplete means that either the three-way TCP handshake did not complete OR the three-way TCP handshake did complete but there was not enough data after the handshake to identify the…

Submitted by fernanda_arg· Apr 18, 2026Operate

Question

Options

AThe client sent a TCP segment with the PUSH flag set.
BThe TCP connection was terminated without identifying any application data.
CThere is insufficient application data after the TCP connection was established.
DThe TCP connection did not fully establish.

How the community answered

(37 responses)

A
3% (1)
C
3% (1)
D
95% (35)

Explanation

"Incomplete" is displayed in the application field if the three-way TCP handshake did not "Incomplete means that either the three-way TCP handshake did not complete OR the three-way TCP handshake did complete but there was not enough data after the handshake to identify the application. In other words that traffic being seen is not really an application." https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClibCAC

Topics

#App-ID#Traffic Logs#TCP Handshake#Session Establishment

Community Discussion

No community discussion yet for this question.

Full PCNSE Practice