What are three reasons why an installed session can be identified with the application incomplete" tag? (Choose three.)

What are three reasons why an installed session can be identified with the application incomplete" tag? (Choose three.)
A . The TCP connection was terminated without identifying any application data
B . The client sent a TCP segment with the PUSH flag set
C . There is not enough application data after the TCP connection was established
D . The TCP connection did not fully establish
E . There was no application data after the TCP connection was established

Answer: A,D,E

Explanation:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClibCAC