By usingsecurity checks under posture settingsinStrata Cloud Manager (SCM), the senior engineer can enforcepolicy compliance standardsbyautomatically denyingany security policy that does notalign with best practices. This ensures that junior engineers can create policies while preventing configurations that might introduce security gaps. This proactive approacheliminates manual oversightand enforces compliance at the time of policy creation, reducing risk and ensuring consistent security enforcement.

The ZTNA Connector initiates all communication outbound, resolving the fully qualified domain name of its assigned Prisma Access cloud gateway and establishing a secure, brokered tunnel to it; correct DNS resolution on the host or network where the connector is deployed is therefore a hard prerequisite for the very first handshake to occur. If the connector ' s DNS settings are misconfigured - pointing to a resolver that cannot resolve the gateway FQDN, or lacking a route to reach that resolver - the connector will fail before it ever gets to the point of negotiating a tunnel, which produces the " fails to establish a connection " symptom described in the question rather than a degraded or unstable connection. This is why option A is the most direct root cause among those listed. Because the connector ' s design is entirely outbound-initiated, it does not require inbound NAT traversal or a publicly reachable listener, so a double NAT (option B) does not, by itself, block the connector from reaching the cloud gateway the way it would for an inbound-listening service.
A dynamic IP address (option C) is explicitly supported, since the connector does not depend on a stable, registered public IP for its outbound session. High latency (option D) can degrade performance and increase connection setup time, but it does not categorically prevent the tunnel from establishing, whereas an unresolved FQDN prevents the connection attempt from ever being initiated correctly.
Reference:Prisma Access ZTNA Connector - Deployment Prerequisites and Connectivity Troubleshooting.

Cloud Dynamic User Groups (CDUGs) are the Cloud Identity Engine capability purpose-built for exactly this use case: rather than relying on a static, manually maintained group whose membership must be updated by hand whenever a user ' s role, department, or other Entra ID attribute changes, a CDUG defines membership criteria based on directory attributes or context - department, title, location, risk score, or other Entra ID fields - and continuously, automatically re-evaluates which users belong to the group as those attributes change. Once created, the resulting group receives an auto-generated distinguished name that Prisma Access recognizes and can reference directly as source identification within a Security policy rule, giving administrators attribute-driven, self-maintaining access control rather than a fixed group membership list. This makes option D the correct capability. " Entra ID Group Attribute " and " Entra ID Cloud Group " (options A and C) are not the names of actual Cloud Identity Engine features; they resemble plausible terminology but do not correspond to a distinct, documented capability distinct from Cloud Dynamic User Groups. " Attribute Group Mapping " (option B) similarly does not exist as a named capability in the Cloud Identity Engine; while group mapping in a general sense is a core CIE function for synchronizing static directory groups, the specific capability that lets a Security policy dynamically use Entra ID attributes as the basis for group/source membership is the Cloud Dynamic User Group, not a generic " attribute group mapping " construct.
Reference:Cloud Identity Engine - Create a Cloud Dynamic User Group.

Service connections enable secure connectivity between Prisma Access and on-premises data centers, allowing mobile users and branch locations to access internal applications. They facilitate seamless integration of internal networks with Prisma Access while maintaining security policies. Colo-Connect provides a dedicated and optimized pathway for traffic between Prisma Access and data centers, ensuring stable performance and reduced latency over the internet. Both components together support secure and efficient data center connectivity while aligning with the customer's access control and filtering requirements.

Preventing paper copies of on-screen information is a data control problem, and PAB ' s actual, named control for this function is the Print control, which can be set to block printing for matching sessions - this is the correct, real mechanism, making option A correct; there is no separate, distinct " kiosk control " object in PAB ' s control set, which makes option B a fabricated distractor rather than a genuine configuration element.
The second requirement - ensuring the policy applies specifically and reliably to this one fixed-location kiosk device - is a matching-criteria problem, and the two candidate approaches offered are location-based scoping and network-based scoping. Location-based policy scope in PAB primarily relies on OS-level location services or GeoIP resolution, both of which are typically imprecise at the level of a single building or office floor and can be unavailable entirely on a locked-down, purpose-built kiosk device that may not have location services enabled or a rich OS profile reporting into it. Network-based scoping, by contrast, lets the administrator match specifically on the corporate office ' s known public IP range or CIDR block, which is a precise, reliable, and location-independent way to guarantee the rule applies consistently to traffic originating from that fixed premises regardless of GeoIP accuracy or device location-service availability - making option D the more dependable and correct match criterion for this exact scenario, and Location-based scope (option C) the weaker, less appropriate choice for a fixed, single-building kiosk enforcement requirement.
Reference:Prisma Access Browser - Print Data Control and Network-Based Policy Scope.