In FortiSASE, the accuracy of application usage reports depends on two primary factors: the ability to identify the application (visibility) and the configuration to log that data (reporting).

Deep Inspection Requirement (D): Modern applications frequently use encryption (SSL/TLS) and dynamic ports. Without Deep Inspection (SSL decryption), the FortiSASE security engine cannot see the application payload and is limited to inspecting headers or SNI. This results in many applications being identified only by their generic protocol (e.g., "SSL" or "HTTPS") and subsequently appearing as Unknown in reports because the specific Layer 7 application signature cannot be matched.

Application Control Monitor Setting (B): Even when an application is correctly identified, it must be properly logged to appear accurately in the "Daily report for application usage". In the inline-CASB (Application Control) profile, categories are assigned actions such as "Allow", "Block", or "Monitor". If categories are set to "Allow" instead of Monitor, the traffic is permitted but granular session details—including the specific application category—may not be logged for reporting purposes, causing them to be grouped into an "Unknown" or "Uncategorized" bucket in high-level summaries.

Analysis of Incorrect Options:

Option A: While certificate inspection provides more visibility than no inspection, it is still insufficient for many applications that require deep packet inspection for identification. Therefore, the lack of Deep inspection (Option D) is the more accurate technical explanation for "Unknown" results.

Option C: ZTNA tags are used for access control and posture-based policy enforcement; they do not impact the application identification engine's ability to categorize traffic flows.