A subcloud is a dedicated cluster of ZIA Public Service Edges within the Zscaler global cloud that is provisioned for a specific organization. The primary benefit is to ensure that an organization's user traffic is processed only by this designated set of nodes. This provides traffic predictability and control, which is often required for regulatory compliance, data sovereignty (ensuring data is processed within a specific geography), or to guarantee performance by using a preferred set of data centers.

A. A subcloud does not increase the total number of Public Service Edges; it dedicates a subset of existing ones to a specific customer.

B. A subcloud is composed of ZIA Public Service Edges; it does not eliminate the need for them.

D. While using specific nodes might incidentally affect geolocation, its primary purpose is traffic steering and data residency, not improving geolocation accuracy.

1. Zscaler Help Portal. (n.d.). About Subclouds. Retrieved from help.zscaler.com. "A subcloud is a set of ZIA Public Service Edges that are dedicated to your organization's traffic... When your organization uses a subcloud, your users' web traffic is forwarded only to the ZIA Public Service Edges in that subcloud."

2. Zscaler Help Portal. (n.d.). Subclouds FAQ. Retrieved from help.zscaler.com. "What is a subcloud? A subcloud is a subset of ZIA Public Service Edges in the Zscaler cloud that is dedicated to an organization. It allows an organization to control which ZIA Public Service Edges their traffic is sent to."

EDU-202 (Zscaler for Users – Engineer) focuses on advanced policy, troubleshooting, and analytics for ZIA/ZPA/ZDX. Client Connector version-control settings (“Enabling versions…”) are covered in the Administrator path (EDU-200) and are therefore outside the scope of EDU-202.

A. High-level platform architecture is explicitly covered in the “Zscaler Platform Overview” course within EDU-202.

C. ZDX configuration and monitoring is one of the eleven Engineer courses.

D. Advanced security services (IPS, DNS Control, Tenant Restrictions, segmentation) are Engineer-level topics.

1. Zscaler University Catalog, “Zscaler for Users – Engineer (EDU-202) Course Outline,” rev 2023-09, pp. 2-4.

2. Zscaler University Catalog, “Zscaler for Users – Administrator (EDU-200) Course Outline,” rev 2023-09, p. 5 (lists Client Connector version control).

Zscaler External Attack Surface Management (EASM) is designed to discover and inventory all of an organization's internet-facing assets to identify potential security risks and exposures. A service hostname that contains revealing information (e.g., dev-db-backup.company.com) is a prime example of a digital entity that EASM would flag. Such a hostname exposes internal naming conventions, infrastructure roles, or development stages, providing valuable reconnaissance information to potential attackers. EASM identifies these assets and the associated risks they present.

B. Client-side certificates for SSL inspection are internal security components, not part of the external, publicly discoverable attack surface.

C. A Zscaler App Connector is an internal infrastructure component used for ZPA and is not intended to be an internet-facing asset.

D. Lists of compromised credentials are a form of threat intelligence, not a digital asset or entity belonging to an organization's attack surface.

1. Zscaler, "Attack Surface Management Datasheet." The document states that the solution discovers "all your internet-facing assets" and identifies "high-risk exposures," including "sensitive information in hostnames."

2. Zscaler, "What Is External Attack Surface Management (EASM)?" This resource explains that EASM tools discover assets like "exposed web servers, forgotten databases," and identify "misconfigurations," which would include poorly chosen, revealing hostnames.

The Domain Joined posture element in ZPA evaluates whether a device belongs to a specific Active

Directory domain. ZPA performs this evaluation using the device’s local posture signals, either

through the Zscaler Client Connector posture engine or through the browser-based posture

evaluation framework used in ZPA Browser Access. When a user connects via Browser Access, ZPA

can still determine domain membership by inspecting the allowed browser posture attributes

provided by the endpoint, enabling device-based Zero Trust controls without requiring a full Client

Connector installation.

Linux endpoints do not support domain-joined posture verification, making option A incorrect.

Domain join validation is performed at the device level, not through the Identity Provider, because

IdPs validate users, not device domain status, eliminating option D. ZPA’s posture configuration

allows you to define multiple domains within a single posture profile, so creating a second posture

profile is unnecessary, making option C incorrect.

Therefore, the correct statement is that ZPA Browser Access can determine whether the device is

joined to the specified domain, which aligns with the expected behavior of the domain-joined

posture element.

In SAML-based authentication, the customer’s IdP (e.g., Azure AD, Okta) performs user authentication, while the Zscaler cloud receives the assertion and delivers the service. Therefore, Zscaler acts as the SAML Service Provider (SP).

A. SaaS gateway is a generic term, not a defined SAML role.

B. The Identity Provider role is handled by the customer’s IdP, not Zscaler.

C. “Identity proxy” is not a formal SAML role and is not used in Zscaler’s SAML flow.

1. Zscaler Help Portal – “Configuring SAML with Zscaler”, Section: Zscaler as the Service Provider, step 1 (docs.zscaler.com/zia/authentication/saml)

2. Zscaler Internet Access Admin Guide, ch. Authentication > SAML Overview, para 3 (“Zscaler operates as the SAML Service Provider”)

The Zscaler Private Access (ZPA) Log Streaming Service (LSS) is designed with a buffering mechanism to handle intermittent connectivity issues with a customer's SIEM. If the connection between the ZPA cloud and the on-premises LSS receiver is lost, the service buffers logs. Upon reconnection, the LSS will retransmit the last 15 minutes of buffered logs to ensure that recent security events are not lost and are available for analysis in the SIEM.

A. The documented retransmission window is 15 minutes, not 20 minutes.

C. The documented retransmission window is 15 minutes, not 60 minutes. The total buffer can be larger, but the retransmit is limited.

D. The documented retransmission window is 15 minutes, not 30 minutes.

1. Zscaler, Inc. "About Log Streaming Service." Zscaler Help Portal for ZPA. Accessed 2023. "If the connection between the ZPA cloud and your LSS receiver is lost, the LSS buffers the logs... However, it only retransmits the last 15 minutes of logs when the connection is restored." (Section: LSS Architecture and Communication).

2. Zscaler, Inc. "Configuring a Log Receiver." Zscaler Help Portal for ZPA. Accessed 2023. "The LSS retransmits the last 15 minutes of logs when the connection to the log receiver is re-established after a disconnection." (Section: LSS Log Buffering and Retransmission).

Zscaler enforces Tenant Restriction by intercepting user authentication requests to cloud applications like Microsoft 365 or Google Workspace. During this process, the Zscaler service inserts specific HTTP headers into the request. These headers contain the identifiers for the organization's approved tenants (e.g., Tenant IDs, domains). The cloud application receives these headers and permits access only to the specified tenants, effectively blocking access to personal or unauthorized accounts while using the corporate network. This method provides granular control without blocking the application entirely.

A. This is the opposite of tenant restriction, which is designed to limit, not unrestrict, access.

B. Blocking all external traffic is an overly broad and disruptive action, not the targeted control provided by tenant restriction.

D. This is a simple block policy. Tenant restriction allows access to approved instances of an application, rather than disabling it completely.

1. Zscaler Help Portal, "About Tenant Restrictions," Section: "How Tenant Restrictions Work." This document states, "When a user authenticates to a cloud application, Zscaler can insert a header into the user's login request that identifies the approved tenants for your organization."

2. Zscaler Help Portal, "Adding Tenant Profiles," Step 2. This section details the specific tenant IDs and domains that are inserted into headers like Restrict-Access-To-Tenants for Microsoft services and X-Goog-Allowed-Domains for Google services.

The Zscaler Cloud Firewall is a component of the Zscaler Zero Trust Exchange platform and is built upon four key policy enforcement engines. These engines work together to provide comprehensive security and control over all network traffic. The four engines are: the DNS Control Module, the Firewall Control Module, the Intrusion Prevention System (IPS) Control Module, and the Web Control Module. Each engine is responsible for inspecting and applying policy to specific types of traffic, ensuring granular control and multi-layered threat protection.

A. This is incorrect; the Zscaler Firewall has four documented key engines, not three.

B. This is incorrect; the Zscaler Firewall has four documented key engines, not two.

C. This is incorrect; the Zscaler Firewall has four documented key engines, not five.

1. Zscaler Help Portal, "About Cloud Firewall," Section: "Cloud Firewall Architecture." This document explicitly lists and describes the four key engines: "The Cloud Firewall has four key engines that work in tandem: DNS Control Module, Firewall Control Module, IPS Control Module, and Web Control Module."

2. Zscaler, "Cloud Firewall Datasheet." The datasheet describes the capabilities that map to these four engines, including "DNS security," "Cloud IPS," "full-featured firewall," and integration with the "secure web gateway (SWG)."

Application segmentation is a core feature of Zscaler Private Access (ZPA), which underpins Zscaler Private AppProtection. It works on the principle of least-privileged access by creating secure segments of one, connecting an authenticated user directly to a specific application without ever placing them on the network. Access policies are defined for each application segment, granting users granular control over which specific applications they can access based on identity, device posture, and other contextual factors. This prevents lateral movement and unauthorized access.

A. Threat Intelligence integration: This feature enhances security by blocking known threats but does not provide the primary mechanism for granular user-to-application access control.

C. Role-based access control: RBAC is a method used to define the policies that govern application segments, but application segmentation is the architectural feature that provides the control.

D. User behavior analysis: This is used to detect anomalous activity and potential threats, rather than being the primary feature for defining and enforcing granular access policies.

1. Zscaler, Inc. "What is Zscaler Private Access (ZPA)?" Zscaler. Accessed 2024. "ZPA is built on a foundation of application segmentation, not network segmentation. Users are never placed on the network..."

2. Zscaler, Inc. "Zscaler Private Access Datasheet." Zscaler. Accessed 2024. "Enable application segmentation to limit user access to specific private applications, reducing the attack surface and preventing lateral threat movement."

3. Zscaler, Inc. "About AppProtection." Zscaler Help Portal. Accessed 2024. This section describes how AppProtection builds upon the core ZPA architecture, which is based on application segmentation.

The scenario describes providing secure, temporary access to a third-party contractor using their own unmanaged device. Zscaler Privileged Remote Access (PRA) is designed for this exact use case. PRA provides agentless, browser-based access to specific internal applications, isolating the session from the contractor's device. This allows the administrator to grant granular, audited access without issuing a corporate laptop, installing a VPN client, or exposing the internal network, ensuring a zero-trust security posture.

A. SD-WAN is a technology for connecting corporate sites (e.g., branch offices to data centers) and is not used for individual user remote access.

B. A Branch Connector is a Zscaler appliance (virtual or physical) used to connect an entire branch office network to the Zscaler cloud, not for an individual contractor.

C. A Cloud Connector is used to extend the Zscaler Zero Trust Exchange to workloads running in public or private clouds, not for end-user access.

1. Zscaler Product Documentation. "Privileged Remote Access". The product overview explicitly states a key use case is "Third-Party Contractor Access" and that it can "Eliminate the need to issue managed laptops to third parties."

2. Zscaler Help Portal. "About Privileged Remote Access". The documentation describes PRA as providing "seamless and secure remote access to private apps for third-party users (e.g., contractors, vendors, etc.) from an unmanaged device."