Zscaler ZDTA Zscaler Digital Transformation Administrator Exam Practice Test

Zscaler supports forwarding methods such as GRE, IPSec, HTTP CONNECT-style proxy tunnels, and Zscaler proprietary microtunnels depending on the use case. SSTP is a Microsoft VPN tunneling protocol, not a supported Zscaler tunnel type for this platform context. Option D (Secure Socket Tunneling Protocol (SSTP)) is correct because SSTP is the unsupported tunnel option.

Why the other options are incorrect:

A. Generic Routing and Encapsulation (GRE): GRE is a location tunnel method normally used from branches or data centers to Zscaler service edges.

B. HTTP Connect Tunnels: HTTP CONNECT tunnels proxy TCP sessions through an HTTP proxy path; they are not Zscaler Tunnel 2.0 DTLS/TLS transport.

C. Proprietary Microtunnels: A Microtunnel is the per-application communication channel ZPA creates between the user and the private app.

Zscaler Access Control Services support Zero Trust by enforcing segmentation and conditional access instead of allowing broad network reach. Preventing lateral movement requires connecting users to specific applications and limiting what they can discover or reach beyond that entitlement. Option B (It protects from potential zero-day threats and advanced persistent threats) is correct because segmentation and conditional access are the controls that reduce lateral-movement risk.

Why the other options are incorrect:

A. It protects sensitive data from leaving through external channels: Stopping sensitive data from leaving is DLP. Cloud Sandbox focuses on detecting unknown malware and advanced threats through detonation.

C. It protects cloud workloads from lateral movement: Cloud workload lateral-movement protection is segmentation/zero trust networking. Sandbox is about suspicious file behavior analysis.

D. It protects users from known malicious files and attacks: Known malicious-file blocking relies on signatures and reputation; sandboxing is mainly for suspicious or unknown objects.

When SSL Inspection policy bypasses a transaction, Zscaler does not decrypt and re-sign the session. Instead, the proxy passes the TLS connection through so the browser receives the real origin-server certificate. This behavior is used for pinned applications, privacy categories, and traffic that should not be decrypted. Option C (When traffic is exempted in SSL Inspection policy rules) is correct because bypassed SSL Inspection rules preserve the server certificate in the user's browser session.

Why the other options are incorrect:

A. When traffic contains a known threat signature: Threat signatures trigger security handling such as blocking or inspection. Passing the real server certificate happens when SSL inspection is bypassed.

B. When web traffic is on custom TCP ports: Custom TCP ports affect traffic handling and forwarding. They do not automatically make Zscaler present the real origin certificate to the browser.

D. When user has connected to server in the past: Past connection history does not decide certificate presentation. The SSL Inspection policy action for the current transaction does.

Layered defense forces attackers to defeat multiple controls, raising operational cost, time, and chance of detection. Zscaler's architecture layers identity, connectivity, TLS inspection, ATP, sandboxing, DLP, segmentation, and analytics rather than relying on one appliance or single signature set. Option A (Layered defense increases costs to attackers to operate) is correct because layered defense increases attacker cost and decreases attacker efficiency.

Why the other options are incorrect:

B. Layered defense from multiple vendor solutions easily share attacker data: Multiple-vendor layering often creates tool silos and inconsistent telemetry. Zscaler’s point is that integrated controls share context in one platform.

C. Layered defense ensures attackers are prevented eventually: “Eventually prevented” is not a security design. Integrated zero trust tries to break the attack chain early and consistently, not hope one layer catches it later.

D. Layered defense with multiple endpoint agents protects from attackers: Stacking endpoint agents can increase conflict and operational overhead. Zscaler’s model reduces reliance on agent sprawl by enforcing policy in the exchange.

TLS/SSL inspection can expose customer content to the inspection service, so the contractual and privacy basis matters. The Zscaler Data Processing Agreement governs how Zscaler processes customer data when services such as ZIA inspect encrypted traffic. It is not merely an acceptable-use or marketing privacy statement. Option D (Zscaler Data Processing Agreement) is correct because the DPA is the agreement that addresses customer-data processing responsibilities.

Why the other options are incorrect:

A. Zscaler Compliance Policy: A compliance policy is an internal rule or control statement. The formal privacy/legal agreement for ZIA data processing is the Data Processing Agreement.

B. Zscaler Privacy Policy: A privacy policy explains how data is handled generally. The customer agreement governing processed data is the Data Processing Agreement.

C. Acceptable Use Policy: An Acceptable Use Policy tells users what behavior is allowed. It is not the contractual data-processing agreement for TLS inspection.

Zscaler PageRisk, specifically the Page Risk Index, is the proprietary scoring capability used in ZIA to evaluate the risk of web pages dynamically. Instead of relying only on static URL blocklists, PageRisk uses a multi-data algorithm that considers page content and domain characteristics. Page-content signals include risky scripts, suspicious iFrames, XSS indicators, vulnerable controls, and other active content. Domain signals include reputation, hosting location, age, and relationships to risky top-level domains. The verified answer is Option B (Zscaler PageRisk) because PageRisk is the Zscaler technology used for real-time website risk scoring.

Why the other options are incorrect:

A. Third-Party Sandbox: A sandbox detonates files to observe malicious behavior. PageRisk is a web-page/domain scoring engine, and Zscaler uses native sandboxing rather than a third-party PageRisk service.

C. Browser Isolation Feedback Form: Browser Isolation renders risky pages remotely to protect the endpoint. A feedback form would collect input; it would not calculate real-time web risk.

D. Deception Controller: The Deception controller manages decoys, lures, and honeytokens for intruder detection. It is about lateral-movement detection, not public website scoring.

Custom DLP dictionaries let administrators define the exact business-specific content that should be treated as sensitive. They can include keywords, phrases, patterns, and regex expressions that match regulated data, internal identifiers, or proprietary terms. Option A (Define specific keywords, phrases, or patterns relevant to their organization's sensitive data policy) is correct because those dictionary entries are what Zscaler uses to detect data in motion.

Why the other options are incorrect:

B. Define specific governance and regulations relevant to their organization's sensitive data policy: Governance and regulatory labels help describe policy intent. A custom dictionary needs the actual sensitive-data tokens: keywords, phrases, or patterns.

C. Define specific SaaS tenant relevant to their organization's sensitive data policy: A SaaS tenant value controls which tenant or instance users may access. Custom dictionaries define content patterns, not tenant boundaries.

D. Define specific file types relevant to their organization's sensitive data policy: File type definitions classify files such as executables or archives. Custom DLP dictionaries define sensitive words, phrases, regexes, or identifiers.

For a deployment using both ZIA and ZPA, the cleanest authentication model is SAML for both services. A shared SAML IdP gives consistent identity, attributes, and group context for internet/SaaS access and private-application access. Option C (Configure Authentication using SAML on both ZIA and ZPA) is correct because using SAML on both ZIA and ZPA provides unified authentication.

Why the other options are incorrect:

A. Use forms Authentication in ZPA and SAML in ZIA: SAML provides browser-based federation by carrying signed assertions from the identity provider to the service provider.

B. Use forms Authentication in ZIA and SAML in ZPA: SAML provides browser-based federation by carrying signed assertions from the identity provider to the service provider.

D. Use forms Authentication for both ZIA and ZPA: Forms authentication is an application-login method. ZIA and ZPA authentication should be based on the supported identity integration model in the scenario, not generic forms auth.

SCIM is the open standard for automated identity provisioning and attribute synchronization. It keeps user, group, and department information updated from the IdP into Zscaler without requiring manual edits or waiting for a new SAML login. Option C (SCIM) is correct because SCIM handles automatic updates to identity attributes.

Why the other options are incorrect:

A. Import: Import is a one-time or manual data-load action. SCIM provides ongoing automated provisioning and synchronization.

B. LDAP Sync: LDAP queries read structured directory data from Active Directory, such as users, groups, and permissions.

D. SAML: SAML provides browser-based federation by carrying signed assertions from the identity provider to the service provider.

Downloaders are malware whose primary job is to retrieve and install additional payloads. They are frequently used as a first-stage infection because the initial file can be small and then pull ransomware, RATs, infostealers, or other malware after execution. Option C (Downloaders) is correct because a downloader's purpose is specifically to deliver other malware.

Why the other options are incorrect:

A. RAT: A remote access trojan gives an attacker interactive control over a compromised host after infection.

B. Maldocs: A malicious document uses macros, embedded objects, or exploit content to run code when opened.

D. Exploitation tool: An exploitation tool attacks a vulnerability. A downloader is the malware type whose purpose is to fetch and install additional malware.

In API architecture, an endpoint is the URL or URI where a client sends a request to access a specific resource or operation. It is not an end-user device or a Zscaler service edge; it is the addressable API resource exposed through the API system. Option B (A URL providing access to a specific resource) is correct because an API endpoint is a URL providing access to a specific resource.

Why the other options are incorrect:

A. An end-user device like a laptop or an OT/IoT device: A laptop or OT/IoT device is a network endpoint, not an API endpoint.

C. Zscaler public service edges: A Zscaler Service Edge enforces traffic policy; it is infrastructure, not the API resource URL itself.

D. Zscaler API gateway providing access to various components: An API gateway brokers and controls API traffic, while an endpoint is the specific resource path being called.

A watering-hole attack compromises a legitimate website or service that the intended victims already trust and commonly visit. The attacker plants malicious active content, such as injected JavaScript or exploit code, so users are infected during normal browsing instead of being lured to an obviously suspicious site. The answer is Option B (Block Suspected phishing sites) because it specifically describes malware hosted on a commonly accessed service, which is the defining trait of this attack type.

Why the other options are incorrect:

A. Configure Advanced Cloud Sandbox policies: Cloud Sandbox detonates and observes suspicious files to identify unknown or advanced malware behavior.

C. Enable Watering Hole detection: A watering-hole attack compromises a legitimate site or service that the victims commonly use.

D. Block Windows executable files from uncategorized websites: Blocking Windows executables from uncategorized sites is a file-type policy example. It is not the forwarding or connector behavior in this question.

Advanced Firewall extends standard firewall capabilities with DNS Tunnel and DNS Application Control. Those controls detect and manage DNS-based tunneling, command channels, or application behavior that simple network-service rules cannot adequately control. Option D (DNS Tunnel and DNS Application Control) is correct because DNS Tunnel and DNS Application Control are advanced firewall features.

Why the other options are incorrect:

A. Destination NAT: Destination NAT rewrites destination addresses. The tested Advanced Firewall value is DNS tunnel/application control, not NAT translation.

B. FQDN Filtering with wildcard: FQDN filtering applies rules to domain names, including wildcard domain patterns where supported.

C. DNS Dashboards, Insights and Logs: DNS resolves names to IP addresses; it is a support service, not an access protocol or scoring engine by itself.

Cloud Browser Isolation protects users by rendering risky web content in a remote browser environment instead of on the endpoint. URL Filtering can use Isolate as an action, so users may still access selected untrusted sites while scripts, active content, and browser-exploit risk remain separated from the device. Option B (A new malicious file was detected by the sandbox due to an “allow and scan” First-Time Action in the sandbox policy) is correct because isolation is an enforceable URL Filtering action, not a separate manual workaround.

Why the other options are incorrect:

A. Zscaler's AI/ML based Smart Browser Isolation was triggered due to a users accessing a newly-registered domain: Browser Isolation renders web content remotely so active content never executes directly on the endpoint.

C. A new malicious file was detected by the sandbox due to an “quarantine” First-Time Action in the sandbox policy: Cloud Sandbox detonates and observes suspicious files to identify unknown or advanced malware behavior.

D. Zscaler detected a HIPAA violation with in-band Data Protection scanning: An in-band HIPAA DLP violation would be inline data-protection scanning. The scenario is asking about the specific log/report signal identified by the correct answer.

Advanced Threat Protection focuses on security outcomes such as blocking phishing, malicious destinations, C2 callbacks, suspicious files, and exploit activity. A CEO's Teams call suffering because of low Wi-Fi signal is a digital-experience problem, not an ATP workflow event. Option B (Reporting high latency from the CEO's Teams call due to a low Wi-Fi signal) is correct because Wi-Fi latency belongs to ZDX troubleshooting, not ATP.

Why the other options are incorrect:

A. IPS coverages for client-side and server-side: IPS inspects traffic inline for exploit signatures and attack patterns, then blocks or resets offending sessions.

C. Comprehensive URL categories for newly registered domains: Newly registered domain categories are part of ATP threat coverage, so they belong in the ATP workflow rather than being the exception.

D. Preventing the download of a password protected zip file: Blocking password-protected ZIP downloads is a threat-protection control because encrypted archives can hide malware from inspection. It is part of ATP-style enforcement, not the non-ATP item.

Cloud Sandbox is built for unknown and suspicious files, especially when static signatures are not enough. The file is detonated in an isolated environment so Zscaler can observe behavior and assign a verdict before allowing it to reach users. Option C (Identify Zero-Day Threats) is correct because sandboxing is most valuable for identifying zero-day threats and advanced malware behavior.

Why the other options are incorrect:

A. Block malware that we have previously identified: Known-malware blocking is signature/reputation enforcement. Cloud Sandbox adds value by analyzing unknown files before a known signature exists.

B. Build a test environment where we can evaluate the result of policies: A test environment for policy evaluation is a lab function. Cloud Sandbox is a malware detonation and behavior-analysis service.

D. Balance threat detection across customers around the world: Balancing detection across customers describes cloud-scale operations. Sandbox’s student-level purpose is to detonate and classify suspicious files.

A Zscaler Client Connector Forwarding Profile determines how traffic is steered to the Zscaler cloud and what fallback behavior applies. For Tunnel 2.0, the profile defines how the client behaves when the preferred DTLS tunnel cannot be established, including fallback to TLS where configured. Option A (Fallback methods and behavior when a DTLS tunnel cannot be established) is correct because DTLS fallback behavior is a Forwarding Profile function.

Why the other options are incorrect:

B. Application PAC file location: A PAC file tells the client or browser which proxy path to use for matching destinations.

C. System PAC file when off trusted network: Trusted Network detection decides whether the device is on a known corporate network using signals such as DNS servers, search domains, gateways, or hostname resolution.

D. Fallback methods and behavior when a TLS tunnel cannot be established: TLS tunneling is the fallback encrypted transport when DTLS is unavailable.

With ZDX Advanced licensing, polling can be configured at a more aggressive interval for faster experience visibility. The minimum polling interval tested here is one minute, which supports quicker detection of experience degradation across monitored applications and users. Option A (1 minute) is correct because one minute is the minimum interval with ZDX Advanced.

Why the other options are incorrect:

B. 10 minutes: Ten minutes is a slower polling cadence than the minimum allowed with ZDX Advanced. The minimum polling interval is one minute.

C. 15 minutes: Fifteen minutes is too slow to be the minimum ZDX Advanced polling interval. ZDX Advanced can poll as frequently as one minute.

D. 5 minutes: Five minutes is a common probe interval in other ZDX contexts, but the minimum polling interval with ZDX Advanced is one minute.

Exact Data Match protects structured sensitive data by converting source values into secure hashes before they are used by Zscaler cloud enforcement. The on-premises EDM VM performs indexing locally so raw customer data is not uploaded into the Zscaler cloud. Only hashed values are used for matching. Option C (To automate the indexing process by creating hashes for structured data elements) is correct because the VM automates indexing and sends hashed data, not clear sensitive records, to the cloud.

Why the other options are incorrect:

A. To local analyze cloud transactions for potential PII exfiltration: Local analysis of cloud transactions describes inline inspection behavior. EDM’s on-premises VM is used before enforcement to hash/index structured data safely.

B. To replicate sensitive data across all organizational servers: Replicating sensitive data everywhere would increase exposure. EDM avoids sending raw sensitive structured data to Zscaler by hashing/indexing it locally.

D. To store sensitive data securely and prevent unauthorized data access: Secure storage is a general data-security objective. The EDM VM’s job is not to become a vault; it prepares hashed indexes for matching.

Zscaler DLP separates detection logic from enforcement policy. Dictionaries contain the sensitive-data patterns, keywords, identifiers, regexes, or fingerprinted data that identify protected information. DLP engines use those dictionaries to evaluate content, and DLP rules or policies decide the enforcement action. Option A (DLP Rules) is correct because the detection foundation of a DLP engine is the dictionary content it evaluates against traffic or files.

Why the other options are incorrect:

B. DLP dictionaries: DLP dictionaries hold the sensitive-data patterns, keywords, identifiers, or fingerprinted values used for detection.

C. DLP Engines: DLP Engines evaluate dictionaries and conditions, but Boolean logic is used when rules combine match conditions into policy logic.

D. DLP identifiers: DLP identifiers are individual match elements, while the broader engine/dictionary structure does the content detection work.

The requirement is tenant-aware SaaS enforcement. ZIA Cloud Application Control can distinguish between the approved corporate instance of an application and a user's personal or unauthorized instance. This is stronger than simple URL filtering because the domain may be the same while the tenant, account, or application activity differs. Option B (Cloud application control) is correct because Cloud App Control is the ZIA control plane used to apply SaaS-specific rules, including tenant restrictions and sanctioned-versus-unsanctioned application decisions.

Why the other options are incorrect:

A. Out-of-band CASB: Out-of-band CASB works through SaaS APIs to inspect or remediate content already sitting inside cloud applications.

C. URL filtering with SSL inspection: URL Filtering controls web destinations by category, URL, risk, and action such as allow, block, caution, or isolate.

D. Endpoint DLP: Endpoint DLP governs local device channels such as USB, print, clipboard, and files in use.

Cloud Browser Isolation protects users by rendering risky web content in a remote browser environment instead of on the endpoint. URL Filtering can use Isolate as an action, so users may still access selected untrusted sites while scripts, active content, and browser-exploit risk remain separated from the device. Option D (Deception) is correct because isolation is an enforceable URL Filtering action, not a separate manual workaround.

Why the other options are incorrect:

A. SandBox: Cloud Sandbox detonates and observes suspicious files to identify unknown or advanced malware behavior.

B. SSL Decryption Bypass: SSL/TLS bypass tells the proxy to pass encrypted traffic without decrypting it for content inspection.

C. Browser Isolation: Browser Isolation renders web content remotely so active content never executes directly on the endpoint.

When multiple ZIA tenants or clouds share the same login domain, Client Connector may display a cloud-selection prompt. The CLOUDNAME installer parameter pins the client to the intended Zscaler cloud so users are not asked to choose during enrollment or login. Option B (Customize an MSI version of the ZCC file specifying the CLOUDNAME variable) is correct because CLOUDNAME removes the cloud-selection ambiguity.

Why the other options are incorrect:

A. Customize an MSI version of the ZCC file specifying the USERDOMAIN variable: userDomain tells Client Connector the user login domain so it can route enrollment toward the right IdP.

C. Federate the login domain between two different IDP instances: Federating the login domain between IdPs changes authentication design. It will not stop Client Connector from showing a cloud-selection menu when the tenant cloud is ambiguous.

D. Create only one SAML integration with the desired ZIA instance: SAML provides browser-based federation by carrying signed assertions from the identity provider to the service provider.

In ZPA, Server Groups define which App Connector Groups can reach the application servers behind an Application Segment. They are part of the mapping that lets ZPA choose the correct outbound connector path for private application traffic. Option C (Maps App Connector Groups to Application Segments) is correct because Server Groups map App Connector Groups to Application Segments for reachability and steering.

Why the other options are incorrect:

A. Maps FQDNs to IP Addresses: DNS resolves names to IP addresses; it is a support service, not an access protocol or scoring engine by itself.

B. Maps Applications to FQDNs: DNS resolves names to IP addresses; it is a support service, not an access protocol or scoring engine by itself.

D. Maps Applications to Application Groups: Mapping applications to application groups is a policy-organization task. Server Groups specifically map reachable application servers to App Connector Groups.

Advanced Threat Protection defends users from malicious active content, phishing, exploit behavior, C2 callbacks, and risky web destinations. It works as part of ZIA's inline security stack, often alongside TLS inspection, Cloud Sandbox, DNS security, IPS, and URL categorization. Option A (Cloud App Control) is correct because malicious active content is the security object ATP is designed to detect and block.

Why the other options are incorrect:

B. URL Filtering: URL Filtering controls web destinations by category, URL, risk, and action such as allow, block, caution, or isolate.

C. Advanced Threat Protection: Advanced Threat Protection blocks malicious active content and related threats. The question is asking for the policy feature named by the configured category, which is not ATP here.

D. Mobile Malware Protection: Mobile Malware Protection focuses on mobile-device malware. The tested ZIA feature is broader web/cloud enforcement rather than mobile-only protection.

Identity Threat Detection and Response focuses on identity risk, particularly in directory environments such as Active Directory. To evaluate AD objects, relationships, permissions, and risky identity configurations, ITDR needs directory-level data rather than raw packet captures or firewall summaries. Option B (Running LDAP queries) is correct because LDAP queries are the standard mechanism for collecting structured AD domain information for identity-risk analysis.

Why the other options are incorrect:

A. Scanning network ports: Port scanning discovers open TCP/UDP services on hosts. ITDR needs AD identity data, so it queries the directory instead of scanning network sockets.

C. Analyzing firewall logs: Firewall logs show network sessions and policy outcomes. They do not expose AD object relationships, permissions, or identity hygiene the way LDAP directory queries do.

D. Packet sniffing: Packet sniffing captures traffic on the wire. ITDR is not passively sniffing packets here; it gathers structured domain information from Active Directory.

Strict Enforcement requires the installer to know both which Zscaler cloud to enroll against and which policy token authorizes the enforcement configuration. The cloudName parameter directs the client to the correct cloud, while policyToken applies the required strict-enforcement policy during enrollment. Option A (cloudName and policyToken) is correct because those two options are the required installer inputs.

Why the other options are incorrect:

B. userDomain and deviceToken: userDomain tells Client Connector the user login domain so it can route enrollment toward the right IdP.

C. cloudName and deviceToken: cloudName tells the installer which Zscaler cloud or tenant environment the client should use.

D. userDomain and policyToken: userDomain tells Client Connector the user login domain so it can route enrollment toward the right IdP.

Zero Trust connections are designed to be independent of network location as a source of trust. The Zero Trust Exchange brokers access based on identity, device posture, application entitlement, and policy, not on whether the user is inside a static corporate network. Option C (They are independent of any network for control or trust) is correct because control and trust come from policy and context, not from the underlying network.

Why the other options are incorrect:

A. They require that SSH inspection be enabled: RDP, SSH, and VNC are privileged remote access protocols for desktop, shell, and graphical administration.

B. They are dependent on a fixed / static network environment: A fixed network dependency is the legacy trust model. Zero Trust removes that dependency by making identity, context, and application policy the trust boundary.

D. They require IPv6: IPv6 may be supported in parts of a network, but Zero Trust connections do not require IPv6 as a design principle.

Data Loss Prevention is the central feature of Zscaler Data Protection. It detects sensitive information using engines, dictionaries, labels, EDM/IDM, and contextual controls, then applies actions such as block, notify, coach, quarantine, or remediate. Option A (Data loss prevention) is correct because DLP is the named core feature for protecting sensitive data.

Why the other options are incorrect:

B. Stopping reconnaissance attacks: Stopping reconnaissance is about hiding attack surface. Data protection addresses exfiltration and accidental data loss.

C. DDoS protection: DDoS protection absorbs or blocks traffic floods. It does not inspect sensitive content leaving through web and cloud channels.

D. Log analysis: Log analysis helps detect and investigate events after collection. DLP use cases prevent the sensitive transfer itself.

Client Connector profile changes do not always take effect at the moment an administrator saves them. App Profile policy settings such as logout password follow the client's scheduled policy-refresh behavior. The tested interval for these policy updates is sixty minutes. Option D (Policy updates occur every 60 minutes, so the logout password will be in effect after the next scheduled update) is correct because the new logout password is applied after the next scheduled policy update.

Why the other options are incorrect:

A. Policy updates happen in real time, so the new logout password is in effect as soon as the change is saved: The logout password is an App Profile control that prevents users from casually signing out or disabling the client.

B. The new logout password will be in effect after the Activate button is clicked in the Admin portal: The logout password is an App Profile control that prevents users from casually signing out or disabling the client.

C. The new logout password will be in effect after the user clicks Update Policy on the client: The logout password is an App Profile control that prevents users from casually signing out or disabling the client.

Z-Tunnel 2.0 extends forwarding beyond web proxy traffic by securing all IP unicast traffic through DTLS/TLS tunnels to the Zero Trust Exchange. This enables Cloud Firewall and other controls to inspect all TCP and UDP ports, and ICMP where supported, rather than only browser HTTP/HTTPS flows. Option C (All TCP and UDP ports as well as ICMP traffic) is correct because Tunnel 2.0 is the all-ports-and-protocols forwarding model for Client Connector.

Why the other options are incorrect:

A. TCP ports 80, 443 and 8080 only: Ports 80, 443, and 8080 describe common web proxy traffic. Tunnel 2.0 forwards broader IP traffic, including TCP, UDP, and ICMP.

B. Any HTTP/HTTPS traffic as well as DNS: DNS resolves names to IP addresses; it is a support service, not an access protocol or scoring engine by itself.

D. All Web ports as well as FTP and SSH: RDP, SSH, and VNC are privileged remote access protocols for desktop, shell, and graphical administration.

A Deception Landmine is endpoint software that plants decoy artifacts such as fake credentials, files, processes, or lures. Those artifacts are designed to attract attackers who are moving laterally or harvesting credentials, causing high-fidelity alerts when touched. Option C (Software agent installed on endpoints, such as desktops or laptops on a network. These agents deploy decoy credentials, files, processes, and lures to other decoys at endpoints) is correct because a Landmine is an endpoint agent that deploys deception lures from the endpoint.

Why the other options are incorrect:

A. Agentless plug-in installed on endpoints, such as desktops or laptops on a network. These plug-ins deploy decoy credentials, files, processes, and lures to other decoys at endpoints: Deception uses decoys, fake credentials, lures, and traps to expose intruders who are exploring the environment.

B. Software agent installed on a centralized server in datacenter or in cloud. The agents running in the server deploy decoy credentials, files, processes, and lures to other decoys at endpoints: Deception uses decoys, fake credentials, lures, and traps to expose intruders who are exploring the environment.

D. Agentless plug-in installed on endpoints, such as desktops or laptops on a network. These plug-ins auto rotates decoy credentials, files, processes, and lures to other decoys at endpoints: Deception uses decoys, fake credentials, lures, and traps to expose intruders who are exploring the environment.

The relationship between App Connector Groups and Server Groups is configured when the Server Group is created or edited. The Server Group points to the App Connector Groups that have visibility to the applications, so ZPA knows which connectors can serve the private traffic. Option B (When a new Server Group is created it points to the App Connector Groups that provide visibility to this Server Group) is correct because Server Group configuration establishes the mapping.

Why the other options are incorrect:

A. The relationship between App Connector Groups and Server Groups is established dynamically in the Zero Trust Exchange as users try to access Applications: A Server Group groups application servers and maps them to App Connector Groups that can reach those servers.

C. Both App Connector Groups and Server Groups are linked together via the Data Center element: A Server Group groups application servers and maps them to App Connector Groups that can reach those servers.

D. When you create a new App Connector Group you must select the list of Server Groups to which it provides visibility: A Server Group groups application servers and maps them to App Connector Groups that can reach those servers.

When trusted corporate locations already forward traffic through GRE or IPSec tunnels, Client Connector should not create a second tunnel on top of the location tunnel while the device is on the trusted network. Off trusted network, however, the client must create its own Tunnel 2.0 path to the Zero Trust Exchange. Option C (None for on-trusted and tunnel v2.0 for off-trusted) is correct because the recommended combination is None on trusted and Tunnel 2.0 off trusted.

Why the other options are incorrect:

A. Tunnel v2.0 for on-trusted and tunnel v2.0 for off-trusted: Tunnel v2.0 on a trusted network would duplicate forwarding when GRE/IPSec tunnels already steer location traffic to Zscaler. On trusted networks, the client should not build another tunnel.

B. None for on-trusted and none for off-trusted: None/None leaves Client Connector without tunnel forwarding on both trusted and untrusted networks. That defeats the intended traffic steering design.

D. Tunnel v2.0 for on-trusted and none for off-trusted: Tunnel v2.0 on trusted and none off trusted reverses the desired behavior. Remote/off-trusted users need Client Connector tunneling; trusted locations already use GRE/IPSec.

ZDX Score is a normalized digital-experience score used to represent how well a user or application is performing. It is expressed on a 1-to-100 scale, making degraded application, network, and endpoint experience easy to compare across users, locations, and time windows. Option A (1-100) is correct because 1-100 is the ZDX scoring range.

Why the other options are incorrect:

B. 1-10: A 1-10 scale is too coarse for ZDX. ZDX uses a 1-100 score so administrators can see more granular experience changes.

C. 1 - 1000: A 1-1000 scale would imply excessive precision that ZDX does not present. The product score is the simpler 1-100 user-experience scale.

D. 0 - 50: A 0-50 range is not the ZDX scale. ZDX scores are represented on a 1-100 scale.

Encrypted traffic must be decrypted before platform services can inspect headers, payloads, files, and content for policy enforcement. TLS Decryption is the Zscaler platform service that converts encrypted sessions into inspectable traffic inside the proxy architecture, then re-encrypts the traffic after policy decisions are applied. Option B (TLS Decryption) is correct because visibility into encrypted communications depends on TLS Inspection/Decryption, not on the downstream policy module itself.

Why the other options are incorrect:

A. Policy Framework: Policy Framework decides what action to take. TLS Inspection is the feature that first makes encrypted traffic visible for those policies.

C. Reporting and Logging: Reporting and logging record what happened. They cannot inspect encrypted payloads unless TLS Inspection has already exposed the content.

D. Device Posture: Device Posture evaluates endpoint health. It does not decrypt traffic or provide visibility into HTTPS payloads.

Advanced Threat Protection defends users from malicious active content, phishing, exploit behavior, C2 callbacks, and risky web destinations. It works as part of ZIA's inline security stack, often alongside TLS inspection, Cloud Sandbox, DNS security, IPS, and URL categorization. Option C (Malicious active content) is correct because malicious active content is the security object ATP is designed to detect and block.

Why the other options are incorrect:

A. Vulnerable JavaScripts: Vulnerable JavaScript describes risky script behavior or client-side code, but it is narrower than the full ATP active-content category.

B. Large iFrames: An iFrame is an embedded page frame; suspicious iFrames can be a signal, but size alone is not the ATP protection category.

D. Command injection attacks: Command injection targets an application or server by passing operating-system commands through vulnerable input fields.

A ZPA microtunnel is the per-application communication channel created after the user is authenticated and authorized. It carries traffic from the user side through the Zscaler service edge to the App Connector path for the internal application. Option D (To create an end-to-end communication channel to internal applications) is correct because the M-Tunnel is built for private application communication, not endpoint-to-endpoint or IdP connectivity.

Why the other options are incorrect:

A. To provide an end-to-end communication channel between ZCC clients: ZCC-to-ZCC communication would be peer endpoint connectivity. A ZPA microtunnel is created from the user side toward a specific internal application.

B. To provide an end-to-end communication channel to Microsoft Applications such as M365: Microsoft 365 optimization uses local breakout, DNS locality, and inspection bypass where Microsoft recommends it for performance.

C. To create an end-to-end communication channel to Azure AD for authentication: Azure AD communication is part of authentication. The microtunnel carries private-application traffic after access is authorized.

ZIA Malware Protection is an inline security control that blocks malicious files or objects detected through signatures, reputation, and threat-intelligence checks. The policy action must stop the malicious transfer rather than simply route, isolate, or change TLS behavior. Option B (Block) is correct because Block is the malware policy action that prevents the identified malicious content from reaching the user.

Why the other options are incorrect:

A. Allow: Allow would permit the file or activity. A sandbox or malware policy often needs to hold, block, or analyze suspicious content instead of simply allowing it.

C. Unwanted Applications: Unwanted Applications is a software/category control. Malware-policy behavior is about malicious content handling.

D. Malware Protection: Malware Protection blocks known malicious objects. Sandbox behavior is used when a file needs detonation or verdict analysis.

Cloud Browser Isolation protects users by rendering risky web content in a remote browser environment instead of on the endpoint. URL Filtering can use Isolate as an action, so users may still access selected untrusted sites while scripts, active content, and browser-exploit risk remain separated from the device. Option A (Browser Isolation) is correct because isolation is an enforceable URL Filtering action, not a separate manual workaround.

Why the other options are incorrect:

B. App Connector: An App Connector brokers outbound connectivity to private apps. It does not make untrusted public URLs safe for user browsing.

C. Zscaler Private Access: ZPA secures private applications. The scenario is public/untrusted web browsing, which is handled by Browser Isolation through ZIA policy.

D. Zscaler Client Connector: Zscaler Client Connector is the endpoint agent that steers traffic, authenticates users, reports posture, and supplies ZDX telemetry.

Experience Center is the unified management console for Zscaler for Users administration. It provides a single administrative entry point for internet and SaaS access, private applications, digital experience monitoring, and endpoint agent configuration. Option C (Experience Center) is correct because Experience Center is the unified console, whereas OneAPI is automation-focused.

Why the other options are incorrect:

A. identity Admin Portal: Identity Admin Portal focuses on identity administration, while the Experience Center is the broader unified console.

B. Mobile Admin Portal: Mobile Admin Portal/Client Connector administration is for endpoint-agent configuration, not the identity-policy component in the stem.

D. One API: OneAPI is the automation API layer. Administrators use Experience Center as the unified graphical console.

Botnet Protection targets command-and-control behavior, including known C2 destinations, suspicious command traffic, and unknown C2 patterns detected through analytics or AI/ML. IPS and YARA-style content analysis are used to identify C2-like traffic and malicious patterns, not general malware categories alone. Option A (Command and Control Traffic) is correct because Command and Control traffic is the botnet behavior being protected against.

Why the other options are incorrect:

B. Ransomware: Ransomware encrypts or extorts data after compromise. It is not the callback/C2 category for outbound spyware communication.

C. Trojans: Trojans disguise malicious code as legitimate software. Spyware callback protection targets outbound communication from spyware to its controller.

D. Adware/Spyware Protection: Adware/spyware protection is a broad category. The tested feature is the specific spyware callback protection control.

SAML authenticates the user at login time, but efficient user provisioning needs automated lifecycle mechanisms. SCIM synchronizes users, groups, and attributes from the IdP, while SAML auto-provisioning/JIT can create users dynamically during successful authentication. Option D (SCIM and SAML Autoprovisioning) is correct because SCIM and SAML auto-provisioning are the efficient provisioning methods.

Why the other options are incorrect:

A. Hosted User Database and Directory Server Synchronization: A hosted user database is manual or local account storage; it does not automate lifecycle changes as cleanly as SCIM/JIT.

B. SAML and Hosted User Database: SAML can create users at sign-in with JIT, but by itself it is an authentication assertion, not continuous lifecycle synchronization like SCIM.

C. SCIM and Directory Server Synchronization: SCIM provisions and synchronizes users, groups, and attributes between an identity provider and Zscaler.

Zscaler Data Protection is primarily adopted to prevent sensitive data from leaving through internet and cloud application channels. The service combines inline DLP, SaaS Security API, endpoint controls, and data discovery to protect data in motion, at rest, and in use. Option C (Prevent loss to Internet and Cloud Apps) is correct because preventing loss to internet and cloud apps is a core data-protection use case.

Why the other options are incorrect:

A. Reduce your Internet Attack Surface: Attack surface is the set of exposed services, addresses, applications, and entry points an attacker can discover.

B. Prevent download of Malicious Files: Blocking malicious downloads is threat protection through malware, ATP, sandbox, or file controls rather than DLP for sensitive data loss.

D. Securely connect users to Private Applications: Secure private-app connectivity is the ZPA use case, not Zscaler Data Protection.

Tamper proofing prevents users or malware from disabling or altering Client Connector after installation. The installer must include the explicit anti-tampering flag to activate that protection during deployment. Option D (--enableAntiTampering) is correct because --enableAntiTampering is the command-line parameter for this control.

Why the other options are incorrect:

A. --secureInstall: --secureInstall sounds like a hardening flag, but the ZCC installer parameter for tamper proofing is --enableAntiTampering.

B. --antiTamper: Anti-tampering prevents local users from disabling or removing Client Connector protections.

C. --disableTampering: Anti-tampering prevents local users from disabling or removing Client Connector protections.