A policy set uses a custom URL category to permit a pilot group ' s...

Answer A is correct. The safest design keeps the pilot domains associated with their security classification and creates a tightly constrained exception for only the approved users and destinations. Zscaler URL categories can retain parent-category classification, while URL Filtering rules can use categories, users, groups, departments, locations, and other criteria. Placing the specific pilot rule above the broader NRD block allows only the intended match; all other newly registered or observed domains continue to reach the global block. Isolation can further reduce exposure when access is necessary but trust is limited. Option B leaves a lower exception unreachable, option C greatly expands the allow surface, and option D weakens protection for everyone. Validate the result in Web Insights after activation. See Zscaler’s policy-enforcement guidance and recommended URL and Cloud App Control policy.