Q: 9
An administrator needs to SSL inspect all traffic but one specific URL category. The administrator decides to create two policies, one to inspect all traffic and another one to bypass the specific category. What is the logical sequence in which they have to appear in the list?
Options
Discussion
B. official exam guide covers this sequencing for policy matching. If still unsure, check Zscaler's admin docs or the practice test.
Has to be B here. In Zscaler (and really most policy engines), the exception gets processed first because it's more specific, so put that policy up top. If you reverse it, the generic inspect-all rule would catch everything and the bypass never applies. Pretty sure that's how their order logic works, but let me know if someone saw it act differently.
I don’t think it’s C. B makes more sense since in ZIA, the exception has to go first or it’ll never get matched with a broad inspect-all rule above it. C is a common mistake. Pretty sure this is how all top-down policy lists work.
C is a trap, B is correct. Exception goes on top or generic rule would block it.
Hard to say, B. You want the exception rule up top or the "inspect all" would catch everything first. ZIA is always first-match, top-down.
B
Had something like this in a mock. ZIA evaluates policies from top to bottom, so you need the exception (bypass) rule above the generic inspect-all one. If you put the catch-all first, nothing else gets a chance to match. Pretty sure that's the logic here but let me know if I missed something.
Had something like this in a mock. ZIA evaluates policies from top to bottom, so you need the exception (bypass) rule above the generic inspect-all one. If you put the catch-all first, nothing else gets a chance to match. Pretty sure that's the logic here but let me know if I missed something.
B , the trap here is thinking Zscaler evaluates all policies, but it's actually top-down first-match.
D sounds right to me. From what I remember, Zscaler checks all policies so you wouldn't have to worry about order, both generic and exception should get evaluated. Maybe I'm missing something but that's how it's worked in my labs. Agree?
Not C, B. Zscaler policy eval is always top-down so exception must come first or you'd miss the bypass.
B/C?
I keep seeing similar practice questions flip between B and C, depends if the generic rule actually covers the exception category. If the 'inspect all' policy includes the bypass category by mistake, putting it first means exception never triggers. But if you scope that policy right, order could be less critical. Still, pretty sure B is safest for ZIA. Disagree?
Be respectful. No spam.