An administrator encountered problems with inbound decryption. Which option should the administrator investigate as part of triage?

An administrator sees several inbound sessions identified as unknown-tcp in the Traffic logs. The administrator determines that these sessions are form external users accessing the company's proprietary accounting application. The administrator wants to reliably identify this traffic as their accounting application and to scan this traffic for threats.
Which option would achieve this result?

What is the purpose of the firewall decryption broker?

Which CLI command is used to simulate traffic going through the firewall and determine which Security policy rule, NAT translation, static route, or PBF rule will be triggered by the traffic?

Which three split tunnel methods are supported by a GlobalProtect Gateway? (Choose three.)