Which three options are selectable in a CI policy for image scanning with Jenkins or twistcli? (Choose three.)

In a CI vulnerability policy (Defend → Vulnerabilities → CI) you can:

• Scope the rule to images built on specific hosts, repositories, or tags;

• Specify that CVEs are only evaluated when a vendor-supplied fix is available;

• Define the failure (build-break) threshold based on CVE severity.

No credential entry is configured in the policy itself, and a “Grace Period” parameter exists only for runtime/registry vulnerability policies, not CI.

B. Credential – Registry/Jenkins credentials are configured outside the CI policy, not as a selectable policy field.

E. Grace Period – Available for runtime/registry policies; CI policies expose no grace-period control.

1. Prisma Cloud Compute Edition Administrator’s Guide v31

“Defend > Vulnerabilities > CI – Add Policy” (table ‘Field descriptions’: Scope

Apply rule only when vendor fix is available

Fail build threshold) – pdf p. 316-317.

2. Palo Alto Networks TechDocs

“Configuring CI Image Scanning Policies”

last updated 2023-10-12

Step 5 (no Credential or Grace Period field).