PCNSE Manage, Monitor and Operate Practice Question

An administrator is analyzing traffic logs on a Palo Alto Networks firewall and notices that a particular session shows an application of 'incomplete' and no bytes received. The session was allowed by the security policy. What is the most likely cause?

⚠ Common exam trap

The trap here is assuming that an allowed session should always have a fully identified application, but application identification requires sufficient data and can be incomplete.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The firewall did not receive enough packets to identify the application.

An 'incomplete' application status in traffic logs indicates that the firewall could not identify the application because it did not receive enough packets or data to match a signature. This can occur with short-lived sessions, asymmetric routing, or when the session is terminated before the application is fully identified. The security policy allowed the session, but application identification failed.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The application is using a non-standard port and was not detected.
Why it's wrong here
While non-standard ports can affect application identification, the firewall uses App-ID which can identify applications regardless of port. If the application is known, it should be identified even on non-standard ports. 'Incomplete' suggests insufficient data, not just port mismatch. Thus, this is less likely.
✗
The security policy is blocking the application, causing incomplete identification.
Why it's wrong here
The scenario states the session was allowed by the security policy. If the policy were blocking, the action would be 'deny' or 'drop'. Blocking does not cause an 'incomplete' application status; it would simply prevent the session. Therefore, this is not the cause.
✗
The application was identified but the session timed out before data was exchanged.
Why it's wrong here
If the application was identified, it would not show as 'incomplete'. The 'incomplete' status indicates that the firewall could not identify the application, often due to insufficient data. A timeout before data exchange would likely result in no application identification, but 'incomplete' specifically means the identification process did not complete.
✓
The firewall did not receive enough packets to identify the application.
Why this is correct
The 'incomplete' application status means the firewall could not identify the application because it did not see enough packets or data. This often happens when the session is terminated early or if the traffic is asymmetric. Without sufficient data, the firewall cannot match the application signature, resulting in 'incomplete'.

Quick reference

Asymmetric Encryption Algorithm Comparison

Algorithm	Key Exchange	Signatures	Equivalent Security Key	Notes
RSA-3072	Yes	Yes	128-bit	Widely deployed; slow for bulk data
ECDSA P-256	No	Yes	128-bit	Fast signatures; standard TLS certs
ECDH / ECDHE	Yes	No	128-bit	Perfect forward secrecy in TLS 1.3
DH / DHE	Yes	No	128-bit (3072-bit key)	Replaced by ECDHE in modern TLS
Ed25519	No	Yes	~128-bit	SSH keys, modern PKI

Go deeper

PCNSE Manage, Monitor and Operate Practice Question

Why each option matters

Option-by-option breakdown

Asymmetric Encryption Algorithm Comparison

Related to this question