Exam JN0-231 topic 1 question 93 discussion

When an application firewall encounters the first packet in a session for which the application has not yet been identified, the typical behavior would be to hold the first packet and subsequent packets until it can identify the application based on the data within the packets. Once the application is identified, the firewall then applies the appropriate rules or policies for that application.

A is correct In application identification, every packet in the flow passes through the application identification engine for processing until the application is identified.

it is D

It´s A

A is correct Application signatures identify an application based on protocol grammar analysis in the first few packets of a session. If the application identification engine has not yet identified the application, it passes the packets and waits for more data. https://www.juniper.net/documentation/us/en/software/junos/application-identification/topics/topic-map/security-application-identification-overview.html

it is D

is it a