Option A converts a correlated campaign finding into consistent, repeatable containment. Zscaler's Splunk deployment guide documents a sample SOAR playbook that uses NSS data and Zscaler APIs, adds an unclassified malicious domain to the ZIA denylist, and identifies exposed users. Its Microsoft Sentinel deployment guide describes playbooks for URL blocking and endpoint or account containment. The workflow can also create an auditable incident ticket. Manual site-by-site triage is slower and produces inconsistent handling. Disabling notifications removes coordination without improving evidence. Raising severity changes queue placement but does not contain the threat. Automated actions should still use scoped credentials, required approvals, error handling, and recorded outcomes.

When you configure a URL Filtering rule with the Caution action, the only HTTP methods you can select for that rule are CONNECT, GET, and HEAD.

The early location-based rule matches the user, destination application, and location, and it contains no request-method limitation. Under ZIA's URL Filtering evaluation model, rules are processed in ascending order and evaluation stops at the first match. The Allow action is therefore applied before the service can evaluate the later PUT and DELETE block. Zscaler exposes the HTTP request method in Web Insights, allowing administrators to confirm that the transaction used PUT and identify the matched policy. Rule specificity does not automatically override numerical order. The high-risk method-aware block must be placed above the broad location allow, or equivalent method and risk conditions must be incorporated into the earlier rule. Conflicting rules do not produce throttling, partial enforcement, or random failures; first-match evaluation produces a deterministic allow in this arrangement.

DLP notification templates can send evidence to the right reviewer or auditor when a policy is triggered. An email notification template is the mechanism that can include or forward a copy of the data that matched the DLP rule, depending on policy configuration and privacy requirements. Option A (Email Notification Template) is correct because it is the DLP notification method used for auditor review.
Why the other options are incorrect:
B). NSS Log Forwarding to SIEM: NSS forwarding sends logs to a SIEM for analysts. End-user DLP coaching or notification is handled by user-facing notification/workflow channels.
C). SMS Text Message via PagerDuty: PagerDuty SMS alerts are operations notifications. The DLP user- notification method in the question is meant to inform or coach the user directly.
D). Zscaler Client Connector pop-up message: Zscaler Client Connector is the endpoint agent that steers traffic, authenticates users, reports posture, and supplies ZDX telemetry.

Zscaler Privileged Remote Access is designed for controlled administrative access to systems without exposing those systems to VPN-style network access. The supported access protocols are the normal privileged-session protocols used by administrators: RDP for Windows desktop administration, SSH for command-line access, and VNC for graphical remote control. That makes Option A (RDP, VNC and SSH) correct. The question is not about general network services; it is about the protocols Zscaler supports for privileged remote sessions through ZPA.
Why the other options are incorrect:
B). RDP, SSH and DHCP: DHCP leases IP addresses to devices. It is useful network plumbing, not a privileged remote access protocol like RDP, SSH, or VNC.
C). SSH, DNS and DHCP: DHCP leases IP addresses to devices. It is useful network plumbing, not a privileged remote access protocol like RDP, SSH, or VNC.
D). RDP, DNS and VNC: DNS resolves names to addresses. Privileged Remote Access needs interactive administration protocols, so DNS is not part of the supported PRA protocol list.