Which three options are selectable in a CI policy for image scanning with Jenkins or twistcli? (Choose three.)

In a CI vulnerability policy (Defend → Vulnerabilities → CI) you can:
• Scope the rule to images built on specific hosts, repositories, or tags;
• Specify that CVEs are only evaluated when a vendor-supplied fix is available;
• Define the failure (build-break) threshold based on CVE severity. No credential entry is configured in the policy itself, and a “Grace Period” parameter exists only for runtime/registry vulnerability policies, not CI.

B. Credential – Registry/Jenkins credentials are configured outside the CI policy, not as a selectable policy field.
E. Grace Period – Available for runtime/registry policies; CI policies expose no grace-period control.

1. Prisma Cloud Compute Edition Administrator’s Guide v31, “Defend > Vulnerabilities > CI – Add Policy” (table ‘Field descriptions’: Scope, Apply rule only when vendor fix is available, Fail build threshold) – pdf p. 316-317.

2. Palo Alto Networks TechDocs, “Configuring CI Image Scanning Policies”, last updated 2023-10-12, Step 5 (no Credential or Grace Period field).