The Zscaler Private Access (ZPA) Log Streaming Service (LSS) is designed with a buffering mechanism to handle intermittent connectivity issues with a customer's SIEM. If the connection between the ZPA cloud and the on-premises LSS receiver is lost, the service buffers logs. Upon reconnection, the LSS will retransmit the last 15 minutes of buffered logs to ensure that recent security events are not lost and are available for analysis in the SIEM.

A. The documented retransmission window is 15 minutes, not 20 minutes.

C. The documented retransmission window is 15 minutes, not 60 minutes. The total buffer can be larger, but the retransmit is limited.

D. The documented retransmission window is 15 minutes, not 30 minutes.

1. Zscaler, Inc. "About Log Streaming Service." Zscaler Help Portal for ZPA. Accessed 2023. "If the connection between the ZPA cloud and your LSS receiver is lost, the LSS buffers the logs... However, it only retransmits the last 15 minutes of logs when the connection is restored." (Section: LSS Architecture and Communication).

2. Zscaler, Inc. "Configuring a Log Receiver." Zscaler Help Portal for ZPA. Accessed 2023. "The LSS retransmits the last 15 minutes of logs when the connection to the log receiver is re-established after a disconnection." (Section: LSS Log Buffering and Retransmission).