Answer D is correct. The high-value rule protects only the applications within its scope. Broad contractor or employee allow rules can still match other internal applications without verifying device posture. Each role-specific allow must therefore require the intended SAML or SCIM identity criteria and compliant posture together, so an unmanaged device cannot qualify merely because its user belongs to an allowed group. The posture-gated sensitive-application rule should remain above broader role rules, followed by the explicit high-value block. Moving the block above the valid posture-based allow would deny compliant users as well. Adding only a Trusted Network condition substitutes location for device trust, and changing unrelated fields does not ensure identity and posture are jointly required. ZPA supports AND and OR operators and first-match rule processing. See Zscaler’s Access Policy overview and Access Policy configuration.