What is causing this behavior?

C is the answer

https://www.juniper.net/techpubs/en_US/junos12.1/information-products/topic-collections/security/software-all/security/junos-security-swconfig-security.pdf
page 1376:
… If a short-lived session starts and ends within the update interval, AppTrack generates a message only at session close.
When you want the initial update message to be sent earlier than the specified update
interval, use the first-update-interval. The first-update-interval lets you enter a shorter
intervalfor the first update only. Alternatively, you can generate the initial update message
at session start by using the first-update option

By default, when each session closes, AppTrack generates a message that provides the byte and packet counts and duration of the session, and sends it to the host device

and :

If you enable AppTrack for a zone and specify a session-update-interval time, whenever a packet is received, AppTrack checks whether the time since the start of the session or since the last update is greater than the update interval. If so, AppTrack updates the counts and sends an update message to the host. If a short-lived session starts and ends within the update interval, AppTrack generates a message only at session close.

http://www.juniper.net/documentation/en_US/junos12.1/topics/concept/app-track-understanding.html

It is C , correct ?

Passed JN0-633 exam recently!

65 multiple choice questions, a little difficult to pass.

Pay close attention to questions on AppQoS, Routing (OSPF, BGP) in VPN (group, auto and hub-and-spoke), AppSecure, troubleshoot of IPSec, etc.

I learned valid JN0-633 dumps here:

http://www.passleader.com/jn0-633.html (209Q VCE and PDF)

Recommend to you!