Option A limits the failure domain while preserving evidence needed to decide whether the release is safe. The Client Connector dashboard reports enrolled-device and service-status information, while ZDX sup plies correlated application, device, and network experience. Zscaler permits administrators to configure automatic updates to the latest or a specified version in its upgrade guidance. It also provides an explicit Client Connector revert setting that allows a return to the previous version when enabled. Keeping the affected operating-system and region cohort isolated enables focused validation and recovery before expansion. Backhauling changes the traffic path and can add latency. Tightening unrelated inspection policy obscures the cause. A global rollout would knowingly multiply the observed tunnel failure across a larger population.