The development team wants to fail CI jobs where a specific CVE is contained within the image. How should the development team configure the pipeline or policy to produce this outcome?

To enforce failure of a CI/CD job based on the presence of a specific CVE, the policy must be configured centrally in the Prisma Cloud Compute Console. An administrator would navigate to Defend > Vulnerabilities > Images > CI and create a new rule. This rule can be configured to trigger on the specific CVE ID and set the action to "Block". When twistcli runs in the CI pipeline, it sends the scan results to the Console, which evaluates them against this policy and returns a fail status if the blocking rule is matched.

A. Set the specific CVE exception as an option in Jenkins or twistcli.: twistcli and its CI plugins do not have command-line flags to block specific CVEs; they act as enforcers for policies defined in the Console.
B. Set the specific CVE exception as an option in Defender running the scan.: Defenders enforce runtime policies and can execute scans, but the CI scan policy logic is managed and configured centrally in the Console.
C. Set the specific CVE exception as an option using the magic string in the Console.: Magic strings (e.g., #twistlock: ignore) are used in Dockerfiles to create exceptions for specific rules, not to create blocking policies.

Palo Alto Networks, Prisma Cloud Compute Administrator's Guide, "CI/CD Integration". This guide explains, "The exit code from twistcli is determined by the rules in the policy that apply to the scan."

Palo Alto Networks, Prisma Cloud Compute Administrator's Guide, "Vulnerability Policies". This section details how to create vulnerability rules, specifying criteria such as CVE ID, severity, and the effect (e.g., Alert, Block, Fail CI build).