The minimum recommended deployment for a production environment is based on ensuring high availability and redundancy. Zscaler's best practice is to deploy App Connectors in pairs (an N+1 model, where N is at least 1) within an App Connector group for each location. This active-active configuration prevents a single point of failure. With four distinct data centers, deploying two App Connectors in each location results in a total of eight App Connectors, providing resilience and load balancing for the applications hosted within each data center.

A. Six - one per data center plus two for cold standby.

App Connectors operate in an active-active model for immediate failover, not a cold standby model. One per data center is not a resilient design.

C. Four - one per data center.

This configuration creates a single point of failure in each data center. If a single App Connector fails, all applications in that location become inaccessible via ZPA.

D. Sixteen - to support a full mesh to the other data centers.

App Connectors do not form a mesh with each other. They establish outbound connections to the Zscaler cloud, which brokers the user-to-application connections.

1. Zscaler Help Portal

"About App Connector Groups." Zscaler

Inc. Accessed May 2024.

Reference: In the "High Availability" section

the documentation states

"For high availability

Zscaler recommends that you deploy App Connectors in pairs. You should have at least two App Connectors for each App Connector group

but you can have more." This directly supports the N+1 (minimum of 2) deployment model per location.

2. Zscaler Help Portal

"App Connector Deployment Prerequisites." Zscaler

Inc. Accessed May 2024.

Reference: Under the "App Connector Deployment" section

it is noted

"To ensure redundancy and high availability

you must deploy App Connectors in pairs. You should have at least two App Connectors running for any given App Connector group..." This reinforces the requirement for pairs to achieve a resilient architecture.

3. Zscaler Help Portal

"ZPA Architecture." Zscaler

Inc. Accessed May 2024.

Reference: The architectural diagrams and descriptions confirm that App Connectors make outbound connections to ZPA Public Service Edges (formerly Zscaler Enforcement Nodes or ZENs). There is no direct App Connector-to-App Connector meshing

invalidating the logic in option D.