Free ZDTA Practice Test Questions and Answers (2026)

The Zscaler SaaS Security API is designed to scan sanctioned SaaS applications for sensitive data at rest and remediate policy violations. A Data Loss Prevention (DLP) rule within this service identifies files containing sensitive information (e.g., PII, financial data). A primary risk is the overexposure of this data through improper sharing. A valid and common remediation action for a DLP violation is to automatically remove external collaborators' access to the file and delete any publicly accessible sharing links, thereby containing the data and preventing loss.

A. Enable AI/ML based Smart Browser Isolation: This is an action associated with Zscaler Internet Access (ZIA) for controlling real-time web traffic and isolating user browsing sessions, not for remediating data at rest found by the SaaS Security API.

B. Quarantine Malware: This is a valid action within the SaaS Security API platform, but it is specifically for a Malware Detection policy, not a Data Loss Prevention (DLP) policy, which is triggered by data content, not malicious code.

C. Create Zero Trust Network Decoy: This is a function of Zscaler's deception technology, used to detect active threats within a network by luring attackers. It is not a remediation action for a DLP policy violation in a SaaS application.

1. Zscaler Help Portal

"Configuring the SaaS Security API DLP Policy": This official documentation outlines the specific actions available for DLP rules. Under the "Add DLP Rule" section

the available remediation actions include "Remove Publicly Sharable Links" and "Remove Collaborators

" which directly supports the correct answer (D). It also lists "Quarantine" as an action for the file itself

but distinguishes this from malware-specific actions.

Reference Location: Zscaler Help Portal > Configuration > SaaS Security API Control > Policy > DLP Policy > Configuring the SaaS Security API DLP Policy.

2. Zscaler Help Portal

"About SaaS Security API": This document provides an overview of the service

stating its purpose is to "scan your SaaS applications for data loss

threats

and compliance violations." It emphasizes control over data at rest

which aligns with the remediation action of managing sharing permissions.

Reference Location: Zscaler Help Portal > Configuration > SaaS Security API Control > About SaaS Security API.

3. Zscaler Help Portal

"Configuring the SaaS Security API Malware Detection Policy": This document details the actions for malware detection

which include "Quarantine" and "Delete." This confirms that "Quarantine Malware" (Option B) is an action tied to a different policy type than the one specified in the question (DLP).

Reference Location: Zscaler Help Portal > Configuration > SaaS Security API Control > Policy > Malware Detection Policy > Configuring the SaaS Security API Malware Detection Policy.

Legacy firewalls, typically deployed in a centralized, hub-and-spoke architecture, create a significant performance bottleneck. All user traffic, including traffic destined for the cloud, must be backhauled to a data center for security inspection. This "hairpinning" or "tromboning" of traffic introduces latency, which degrades application performance and harms the user experience. As organizations adopt more cloud-based applications (SaaS, IaaS), this performance degradation becomes a major business risk, directly impacting employee productivity and operational agility. The intensive processing required for tasks like SSL/TLS inspection further strains these hardware-based appliances, often forcing a trade-off between security and performance.

B. Reduced management: Legacy firewalls require increased management, involving complex policy administration, patching, and hardware maintenance across multiple physical locations.

C. Low costs: The total cost of ownership (TCO) for legacy firewalls is high, encompassing hardware refresh cycles, expensive maintenance contracts, and bandwidth costs for backhauling traffic.

D. Low licensing support: Major firewall vendors typically offer robust (though costly) support contracts; the primary business risk is the architectural limitation, not the support for licenses.

1. Zscaler Official Documentation

"What is a Firewall?": "Traditional firewalls

especially next-generation firewalls (NGFWs)

can become a bottleneck

slowing down network traffic and hindering productivity. This is because all traffic must pass through the firewall for inspection

which can be a slow process

especially for encrypted traffic." (Found under the section "What are the limitations of a firewall?")

2. Zscaler Whitepaper

"The 5 Tenets of Zero Trust": "The hub-and-spoke network architecture

with its centralized security stack

was designed for a world where applications resided in the data center. When you backhaul cloud-bound traffic to your data center for security

you introduce latency

degrade the user experience

and increase costs." (Page 4

Section: "The Old Way: Castle-and-Moat Security")

3. Zscaler Solution Brief

"Transform Your Network Security with Zscaler": "Legacy network security

built around the corporate data center

is no longer adequate. Backhauling traffic from branch offices to a central security stack adds latency and impairs the performance of cloud applications." (Page 1

Introduction)

When using SAML for authentication, the most efficient provisioning methods are those that are automated and tightly integrated with the Identity Provider (IdP).

SCIM (System for Cross-domain Identity Management) is an open standard designed for automating the exchange of user identity information. It enables real-time, automated provisioning, attribute updates, and de-provisioning of users and groups from the IdP to Zscaler, ensuring the user database is always synchronized.

SAML Autoprovisioning, also known as Just-in-Time (JIT) provisioning, automatically creates a user account in the Zscaler service during their first successful SAML authentication. This eliminates the need to pre-provision accounts, making it highly efficient for initial user onboarding.

A. Hosted User Database and Directory Server Synchronization: The Hosted User Database requires manual CSV uploads or individual user creation, which is the least efficient method.

B. SAML and Hosted User Database: The Hosted User Database is inefficient. While SAML is used for authentication, the specific provisioning feature is called "SAML Autoprovisioning."

C. SCIM and Directory Server Synchronization: Directory Server Synchronization is a scheduled batch process, making it less efficient and real-time than SAML Autoprovisioning for initial user creation in a SAML-centric environment.

1. Zscaler Help Portal

"About Provisioning and Authenticating Users." This document outlines the primary methods for provisioning. It states

"You can provision users

groups

and departments to the Zscaler service in the following ways: SAML Auto-Provisioning

SCIM Provisioning

Directory Synchronization." This directly lists the two correct options as primary methods.

2. Zscaler Help Portal

"About SCIM." This document describes SCIM as an "open standard that automates user provisioning" and allows for automatic provisioning and de-provisioning from an IdP to Zscaler

highlighting its efficiency.

3. Zscaler Help Portal

"Configuring SAML." In the configuration steps for SAML

the guide details the "Enable SAML Auto-Provisioning" option. It explains: "When a user logs in to the Zscaler service for the first time

the service can automatically create an account for the user... This is known as auto-provisioning." This confirms it as a distinct

efficient method tied to the SAML process.

An Access Policy in Zscaler Private Access (ZPA) is a rule that dictates access to internal applications. Each policy rule is defined by a set of conditions (criteria) and a single, specific action. When the conditions are met, the policy applies its configured action, which can be either "Allow Access" or "Block Access". The targets of this action, defined within the same rule, can be a combination of individual Application Segments and entire Application Segment Groups. This structure allows for both granular control over specific applications and broad, scalable management over logical groupings of applications.

A. The use of "OR" is imprecise. A policy rule can target both Application Segments and Application Segment Groups simultaneously, not just one or the other.

B. A single Access Policy rule is configured with only one action. It cannot be configured to simultaneously allow one target and block another.

D. Similar to option B, a single Access Policy rule has a unitary action (either Allow or Block) and cannot perform conflicting actions on different targets.

---

1. Zscaler Help Portal

"About Access Policy": "An Access Policy rule consists of two main building blocks: criteria and an action. The criteria for a rule consists of logical expressions that use SAML and SCIM attributes

as well as other criteria (e.g.

client types

location

etc.). The action for the rule can be set to either Allow Access or Block Access." This document confirms that a single rule has a single action.

2. Zscaler Help Portal

"Configuring Access Policies": In the step-by-step guide for creating an Access Policy

Step 2

"Applications

" shows that an administrator can select both Application Segments and Application Segment Groups as targets for the rule. Step 4

"Access

" shows a single "Action" dropdown menu for the entire rule with the options "Allow Access" and "Block Access". This demonstrates that one action is applied to all selected targets

which can be a mix of segments and groups.

3. Zscaler Help Portal

"About Application Segment Groups": "Application Segment Groups allow you to group a set of application segments together. This is useful when you need to apply the same Access Policy or Client Forwarding Policy to multiple application segments." This confirms that Application Segment Groups are valid targets for an Access Policy.

The Zscaler Cloud Firewall is built upon a proxy-based architecture that performs Deep Packet Inspection (DPI) on all traffic, regardless of the port used. This core capability allows the firewall to identify the true protocol and application of a data stream, even if it attempts to use a non-standard port to evade detection. Once the application is correctly identified through DPI, the traffic is passed to the relevant policy and threat inspection engines within the Zscaler Zero Trust Exchange. This ensures that security policies are applied accurately based on the application's identity, not just its port, effectively neutralizing evasion techniques.

B. Zscaler Client Connector's primary function is to securely forward traffic to the Zscaler cloud for inspection, not to perform local evasion detection.

C. The Zscaler service is designed to inspect traffic directly in the cloud, often replacing or augmenting on-premise firewalls, not relying on them for evasion detection.

D. While the Intrusion Prevention System (IPS) is a component, DPI is the foundational technology for identifying the protocol. The action is policy-driven, not limited to just blocking.

1. Zscaler. (n.d.). Cloud Firewall [Data Sheet]. Retrieved from Zscaler resources. In the "Key Features" section

it states

"Full DPI for all ports and protocols. Zscaler identifies applications and protocols regardless of the port they use

preventing unauthorized applications and protocol tunneling."

2. Zscaler Help Portal. (2024). About Firewall Control. "The Zscaler service provides full deep packet inspection (DPI)

allowing you to control and protect your traffic. You can create policies to control network applications..." This confirms that DPI is the mechanism used to identify applications for policy control.

3. Zscaler Help Portal. (2024). Understanding the Zscaler Architecture. "The Zscaler patented proxy architecture provides full inline inspection of all your user traffic... The single-scan multi-action (SSMA) technology inspects all traffic in a single pass." This document describes the core inspection engine that enables DPI across all traffic.

The Zscaler Forwarding Profile is a crucial component for configuring how the Zscaler Client Connector directs traffic to the Zscaler cloud. When using Z-Tunnel 2.0, the profile allows administrators to set the primary transport protocol, which is typically DTLS (Datagram Transport Layer Security) for better performance. A key function of the Forwarding Profile is to define the fallback behavior. If a user's network blocks UDP traffic and a DTLS tunnel cannot be established, the profile dictates that the Client Connector should automatically fall back to using a TLS (Transport Layer Security) tunnel to ensure uninterrupted service.

B. The Application PAC file location is specified within the App Profile, which controls the Zscaler Client Connector's settings, not the Forwarding Profile.

C. The Forwarding Profile defines the forwarding method for different network states (e.g., Off Trusted), but the PAC file URL itself is managed in the App Profile.

D. The primary fallback mechanism is from DTLS to TLS. If a TLS tunnel also fails, the configured action is typically to fail open or fail closed, not fall back to another tunnel.

1. Zscaler Help Portal

"About Forwarding Profiles": "In the forwarding profile

you can configure Z-Tunnel 2.0 settings. Z-Tunnel 2.0 is the default tunneling method for Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA). It is a tunneling architecture that uses DTLS or TLS to send traffic to the Zscaler cloud... If you select DTLS as the primary transport

Zscaler Client Connector uses DTLS for the primary tunnel. If a user's network does not allow DTLS

the app automatically falls back to TLS." (Section: About Z-Tunnel 2.0 Settings)

2. Zscaler Help Portal

"Configuring Forwarding Profiles": "For Tunnel Driver

select Packet Filter Based. This is the default tunnel driver for Z-Tunnel 2.0... For DTLS

select whether you want to use it as the primary transport over TLS. If you select DTLS

Zscaler Client Connector uses DTLS for the primary tunnel. If a user's network does not allow DTLS

the app automatically falls back to TLS." (Section: Configuring Basic Forwarding Profile Information

Step 5)

3. Zscaler Help Portal

"About App Profiles": "In the Zscaler Client Connector Portal

you can configure app profiles to control Zscaler Client Connector... You can also specify a custom PAC file for the app to use." (Section: About App Profiles

Overview)

Inline Data Protection refers to the real-time inspection and policy enforcement on data as it travels through a network path. Blocking the attachment of a sensitive document in webmail is a classic example of this. The Zscaler service, acting as a secure web gateway, intercepts the user's HTTP/S traffic, inspects the file content during the upload attempt, and blocks the transmission if it violates a Data Loss Prevention (DLP) policy. This action occurs "in the line" of traffic, preventing the data exfiltration before it is completed.

A. Preventing the copying of a sensitive document to a USB drive is a function of Endpoint DLP, which operates on the user's device, not on network traffic in transit.

B. Preventing the sharing of a sensitive document in OneDrive is often handled by an out-of-band CASB API integration, which scans data at rest and permissions, not data in transit.

C. Analyzing a customer’s M365 tenant for security best practices is a Cloud Security Posture Management (CSPM) function, which assesses configurations, not real-time data flow.

---

1. Zscaler Help Portal

"About Data Loss Prevention": "Zscaler Data Loss Prevention (DLP) allows you to create policies that prevent data leakage from your organization's network. You can use Zscaler's predefined DLP engines or create your own custom engines to scan your organization's outbound traffic (e.g.

web

FTP

etc.)." This document establishes that Zscaler DLP operates on outbound traffic

which is by definition an inline inspection process. The example of webmail falls directly under this use case.

(Reference: Zscaler Help Portal

help.zscaler.com

search for "About Data Loss Prevention".)

2. Zscaler Data Sheet

"Cloud Data Loss Prevention (DLP)": This document distinguishes between different DLP channels. It describes inline protection as "Prevent data loss over all web traffic

including webmail

social media

and personal cloud storage." This directly supports option D as a primary example of inline DLP.

(Reference: Zscaler

Inc. "Cloud Data Loss Prevention (DLP)" Data Sheet

2023

Page 1

Section: "Unified DLP across all channels".)

3. Zscaler Help Portal

"About SaaS Security API": This documentation describes out-of-band protection

stating it "provides visibility and policy control over data at rest within your organization's sanctioned SaaS applications." This clarifies why options B and C

which involve scanning applications at rest (OneDrive) and configurations (M365 tenant)

are not examples of inline protection.

(Reference: Zscaler Help Portal

help.zscaler.com

search for "About SaaS Security API".)

Certificate pinning is a security mechanism where an application is configured to trust only a specific server certificate. When Zscaler Internet Access (ZIA) performs SSL inspection, it presents its own certificate to the client application, which is signed by the Zscaler root CA. A certificate-pinned application will reject this certificate because it does not match the "pinned" one, causing the TLS/SSL connection to fail. The Zscaler administrator can diagnose this by reviewing the Web Insights SSL logs, where this event will be recorded as a "Failed Client Handshake," indicating the client application terminated the connection.

B. Rebooting the endpoint is a generic troubleshooting step that will not resolve the fundamental certificate mismatch caused by pinning.

C. The ZIA Web Policy is used to define access rules, not to diagnose TLS/SSL handshake failures at the protocol level.

D. The SaaS application analytics tab provides high-level insights into application usage and risk, not detailed connection-level error logs.

1. Zscaler Help Portal

"Troubleshooting Certificate Pinned Applications": "When Zscaler SSL inspection is enabled

certificate-pinned applications break because the Zscaler root certificate is not the pinned certificate." This document establishes that the application will fail due to the certificate mismatch

a failure that is logged. The solution described (bypassing SSL inspection) is what an administrator would do after identifying the failure in the logs.

2. Zscaler Help Portal

"Web Insights Logs: Columns": The documentation for Web Insights Logs details the "SSL Error" column. This column provides specific information about SSL handshake failures

including errors like "Failed Client Handshake

" which is the direct indicator of a certificate pinning issue when SSL inspection is active.

3. Zscaler Help Portal

"About SSL Inspection": "Some applications and websites use a technique called certificate pinning... If you enable SSL inspection for traffic to these sites or applications

the Zscaler service will be unable to decrypt the traffic

and users will not be able to access them." This confirms that the failure is an expected outcome of inspecting pinned traffic

and the logs are the tool to observe this failure.

Zscaler Internet Access (ZIA) policies, including SSL Inspection, are evaluated using a top-down, first-match logic. The policy engine processes rules in their listed order, starting from rule number 1. When a traffic flow matches the criteria of a rule, that rule's action is applied, and the evaluation process stops for that flow; no subsequent rules are considered. To create an exception, the more specific rule (e.g., bypassing a specific URL category) must be placed at a higher order than the more general, catch-all rule (e.g., "inspect all"). This ensures the exception is processed first.

A. The policies are compatible and designed to be used together to create granular control by defining exceptions to general rules.

C. Placing the generic "inspect all" rule first would cause it to match all traffic, so the more specific exception rule would never be evaluated.

D. Policy order is critical in Zscaler's first-match evaluation logic; only the first matching policy is applied, not all of them.

1. Zscaler Help Portal

"Configuring SSL Inspection Policy": "The ZIA Admin Portal enforces policy rule order. The service evaluates rules in ascending order

from 1 to n... As soon as the service finds a policy rule that matches the traffic

it applies that rule and stops processing any other rules." This document explicitly details the first-match

top-down processing order.

2. Zscaler Help Portal

"Recommended SSL Inspection Policy": Under the section "Creating the SSL Inspection Rule

" the best practice states: "Zscaler recommends that you create SSL inspection rules for traffic that you want to exempt from inspection first. Then

create a final rule that inspects all other traffic." This directly validates placing the exception (bypass) rule before the general (inspect all) rule.

Zscaler oneAPI utilizes the OAuth 2.0 authorization framework for authentication, specifically employing the Client Credentials grant type. In this flow, an API client uses its pre-configured Client ID and Client Secret to request an access token from the Zscaler authentication server. This bearer token must then be presented in the Authorization header for all subsequent API calls. OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0. Among the choices provided, OIDC is the most accurate representation of the modern, token-based authentication mechanism that Zscaler has implemented for its oneAPI platform.

B. Transport Layer Security (TLS) is a protocol for encrypting data in transit. While API calls must be made over a TLS-secured channel (HTTPS), TLS itself is not the method for authenticating the client to the API service.

C. Security Assertion Markup Language (SAML) is a standard primarily designed for web-based Single Sign-On (SSO) for human users, not for the server-to-server or programmatic authentication required by APIs.

D. System for Cross-domain Identity Management (SCIM) is a protocol for automating user provisioning (e.g., creating, updating, and deleting user accounts), not for authenticating API requests.

1. Zscaler Help Portal

"About oneAPI": This document states

"oneAPI uses the OAuth 2.0 authorization framework with the Client Credentials grant type for authentication. To authenticate to oneAPI

you must first create an API key in the Zscaler Cloud & Branch Connector Admin Portal. The API key consists of a Client ID and a Client Secret. You then use the Client ID and Client Secret to obtain a bearer token from the Zscaler authentication server." (Section: Authentication)

2. Zscaler Help Portal

"Getting Started with oneAPI": This guide provides a step-by-step walkthrough of the authentication process

detailing how to "Obtain a Bearer Token" by making a POST request to the /oauth/token endpoint using the clientcredentials grant type. (Section: Step 2: Obtain a Bearer Token)

Zscaler Advanced Threat Protection (ATP) is a security-focused module within Zscaler Internet Access (ZIA) designed to protect against sophisticated cyber threats. Its workflow includes Intrusion Prevention System (IPS) signatures, advanced URL filtering for high-risk categories like newly registered domains, and policies to block potentially malicious, unscannable files such as password-protected archives.

Reporting on application latency or performance issues, such as a poor Teams call due to a weak WiFi signal, is not a security function. This task falls under the domain of digital experience monitoring, which is handled by a separate Zscaler service, Zscaler Digital Experience (ZDX), not by the ATP security engine.

A. IPS is a fundamental component of Zscaler's layered defense and ATP, using signatures to block known exploits and threats targeting clients and servers.

C. Proactively categorizing and applying security policies to newly registered domains is a key ATP strategy to mitigate phishing and malware distribution campaigns.

D. Blocking password-protected files is a common security policy within ATP, as their contents cannot be inspected for malware, representing a significant risk.

1. Zscaler Help Portal

"About Advanced Threat Protection": This document outlines the core features of ATP

stating it provides "advanced protection against malicious content from websites

" including "protection against botnet command and control (C&C) networks" and "protection against phishing sites." It also details the integration of IPS controls. This confirms that options A and C are part of the ATP workflow.

2. Zscaler Help Portal

"About Zscaler Digital Experience": This resource describes ZDX as a "user-centric monitoring solution that provides end-to-end visibility of the user-to-app performance." It explicitly mentions monitoring for performance issues

which directly aligns with the scenario in option B and separates it from the security functions of ATP.

3. Zscaler Help Portal

"Configuring Malware Protection Policies": In the section on File Type Control

this guide explains the policy for handling unscannable files. It states

"Zscaler recommends that you block password-protected archives and documents because they cannot be scanned for viruses and spyware

" confirming that blocking such files (Option D) is a security function within ZIA's threat protection capabilities.

URL Filtering remains a cornerstone of modern web security and a fundamental component of a Secure Web Gateway (SWG) and Zero Trust architecture. It functions as an efficient and scalable first line of defense by categorizing and applying policy to web destinations before more resource-intensive inspections, like deep content analysis or sandboxing, are performed. In the Zscaler Zero Trust Exchange, URL filtering is applied inline to all traffic, including encrypted sessions via TLS inspection, to enforce security and acceptable use policies, proving its continued effectiveness and relevance.

B: This approach is the opposite of a Zero Trust security model, which operates on a principle of "never trust, always verify" and default-deny, not default-allow.

C: CASB and URL Filtering are complementary, not mutually exclusive. URL Filtering provides broad web access control, while CASB offers granular control over specific cloud applications.

D: This is incorrect. Modern security services like the Zscaler proxy perform TLS/SSL inspection, allowing them to decrypt, inspect, and enforce policies on encrypted traffic, including the full URL.

1. Zscaler Help Portal

"About URL Filtering": "The URL Filtering policy allows you to control the web traffic that is sent from your organization to the internet. The Zscaler service categorizes URLs and provides URL super-categories and categories that you can use in your policy." This document establishes URL Filtering as a primary policy control mechanism within the Zscaler platform.

2. Zscaler Help Portal

"About SSL Inspection": "With the Zscaler service

you can decrypt

inspect

and re-encrypt all of your SSL-encrypted traffic... When the Zscaler service inspects SSL traffic

it can enforce policies

such as URL Filtering... on the decrypted traffic." This source directly refutes the claim that HTTPS renders URL Filtering ineffective.

3. Zscaler

"What is a Secure Web Gateway (SWG)?": "A core function of any SWG is URL filtering

which controls access to websites based on their category... This is a first line of defense against web-based threats." This official Zscaler resource explicitly defines URL filtering as a "first line of defense."

4. Zscaler

"The Zscaler Zero Trust Exchange" (Whitepaper): The principles outlined in this document are based on least-privileged access and inspecting all traffic. The concept of granting access to all internet sites by default (as suggested in option B) is fundamentally incompatible with the Zero Trust model that Zscaler is built upon.

A ZIA Sublocation is a logical construct used to segment traffic within a broader, defined Location. It is defined by specific IP address ranges or subnets that are part of the parent Location's network. This allows an organization to apply distinct security policies, such as URL Filtering or Cloud App Control, to different groups of users or network segments that share the same internet egress point. A primary example is creating a sublocation for a guest Wi-Fi network to enforce stricter policies compared to the corporate network, even though both traffic types exit through the same gateway.

B: A Sublocation's purpose is for policy enforcement and is not defined by its relationship to a Zscaler Subcloud, which is an element of Zscaler's cloud architecture.

C: Sublocations are defined by distinct, non-overlapping IP subnets within a location to differentiate traffic, not to manage or identify overlapping IP addresses.

D: A sublocation is defined by an IP address or subnet, which is independent of the traffic forwarding method, such as Zscaler Client Connector versus a GRE tunnel.

1. Zscaler Help Portal

"About Sublocations": "You can create sub-locations for a location to apply different policies to different subnets within the location... A common use case is to create a sub-location for your guest Wi-Fi network. This allows you to apply a stricter policy to your guest Wi-Fi network." This source directly validates that sublocations are for segmenting traffic (like guest vs. employee) for policy application.

2. Zscaler Help Portal

"Configuring Locations": Under the "Sub-Locations" section

the documentation states

"Sub-locations are prefixes of the static IP addresses that are configured for the location. You can define sub-locations to apply policies on a more granular level." This confirms that sublocations are IP-based subsets of a location used for granular policy.

The minimum recommended deployment for a production environment is based on ensuring high availability and redundancy. Zscaler's best practice is to deploy App Connectors in pairs (an N+1 model, where N is at least 1) within an App Connector group for each location. This active-active configuration prevents a single point of failure. With four distinct data centers, deploying two App Connectors in each location results in a total of eight App Connectors, providing resilience and load balancing for the applications hosted within each data center.

A. Six - one per data center plus two for cold standby.

App Connectors operate in an active-active model for immediate failover, not a cold standby model. One per data center is not a resilient design.

C. Four - one per data center.

This configuration creates a single point of failure in each data center. If a single App Connector fails, all applications in that location become inaccessible via ZPA.

D. Sixteen - to support a full mesh to the other data centers.

App Connectors do not form a mesh with each other. They establish outbound connections to the Zscaler cloud, which brokers the user-to-application connections.

1. Zscaler Help Portal

"About App Connector Groups." Zscaler

Inc. Accessed May 2024.

Reference: In the "High Availability" section

the documentation states

"For high availability

Zscaler recommends that you deploy App Connectors in pairs. You should have at least two App Connectors for each App Connector group

but you can have more." This directly supports the N+1 (minimum of 2) deployment model per location.

2. Zscaler Help Portal

"App Connector Deployment Prerequisites." Zscaler

Inc. Accessed May 2024.

Reference: Under the "App Connector Deployment" section

it is noted

"To ensure redundancy and high availability

you must deploy App Connectors in pairs. You should have at least two App Connectors running for any given App Connector group..." This reinforces the requirement for pairs to achieve a resilient architecture.

3. Zscaler Help Portal

"ZPA Architecture." Zscaler

Inc. Accessed May 2024.

Reference: The architectural diagrams and descriptions confirm that App Connectors make outbound connections to ZPA Public Service Edges (formerly Zscaler Enforcement Nodes or ZENs). There is no direct App Connector-to-App Connector meshing

invalidating the logic in option D.

The Zscaler Microtunnel (M-Tunnel) is a fundamental component of the Zscaler Private Access (ZPA) architecture. Its primary purpose is to establish a secure, on-demand, end-to-end encrypted tunnel from a user's device to a specific internal (private) application. When a user requests access, ZPA dynamically creates an M-Tunnel that connects the Zscaler Client Connector (ZCC) on the user's device to the App Connector co-located with the application. This process ensures that users are never placed on the network and are granted direct, policy-based access only to the applications they are authorized to use, embodying a zero trust security model.

A. ZPA M-Tunnels are designed for user-to-application communication, not for direct peer-to-peer connections between Zscaler Client Connector (ZCC) clients.

B. M-Tunnels are for accessing private applications. Access to public SaaS applications like Microsoft 365 is typically secured through Zscaler Internet Access (ZIA).

C. Authentication is handled by an Identity Provider (IdP) like Azure AD before an M-Tunnel is established. The M-Tunnel is for application access post-authentication.

1. Zscaler Help Portal

"About Microtunnels": "When a user requests access to an application

ZPA establishes a secure

end-to-end encrypted tunnel

called a Microtunnel (M-Tunnel)

between the user's device and the application. The M-Tunnel ensures that the user has a direct

secure path to the application without ever being placed on the network."

2. Zscaler Help Portal

"Understanding Zscaler Private Access (ZPA)": "ZPA is a cloud service that provides secure

zero trust access to internal applications... ZPA uses inside-out connectivity to connect users to applications... This connection is established using a lightweight Zscaler software called Zscaler Client Connector on the user's device and App Connectors in the data center where the applications are hosted." The M-Tunnel is the mechanism for this connection.

3. Zscaler Help Portal

"About Zscaler Client Connector": "For ZPA

Zscaler Client Connector creates a secure

private microtunnel that connects the user's device directly to the apps they need

without having to connect to the network."

When Zscaler performs SSL/TLS inspection for traffic to a private application, it functions as a full proxy, executing a Man-in-the-Middle (MITM) process. The Zscaler Service Edge intercepts and terminates the TLS connection initiated by the user's browser. It then establishes a separate, new TLS connection to the private application's server. To present a valid certificate back to the user's browser for the intercepted session, Zscaler dynamically generates a certificate for the requested application domain. This new certificate is signed by the Zscaler Root CA, which must be trusted by the user's client device. The user's browser, therefore, sees this Zscaler-generated MITM certificate, not the application's original certificate.

A. An HTTPS session always requires a certificate to be presented to the browser to establish a secure, encrypted connection.

B. The certificate is signed by the trusted Zscaler Root CA, not a typical untrusted, self-signed certificate.

C. The real server certificate is presented to the Zscaler Service Edge, not the user's browser, during an inspected session.

1. Zscaler Help Portal

"About SSL Inspection": "To inspect SSL traffic

the Zscaler service establishes a separate SSL tunnel with the destination server and with the user's browser. It then decrypts and inspects the content passing between the two tunnels. To do this

the Zscaler service uses a Zscaler-signed certificate... The Zscaler service dynamically generates a certificate and signs it with the Zscaler root certificate." (help.zscaler.com/zia/about-ssl-inspection)

2. Zscaler Help Portal

"Using Your Own Certificate for SSL Inspection": "When performing SSL inspection

the Zscaler service uses a Zscaler-signed certificate by default. It dynamically generates a certificate and signs it with the Zscaler root certificate." (help.zscaler.com/zia/using-your-own-certificate-ssl-inspection)

3. Zscaler Whitepaper

"The Zscaler Zero Trust Exchange Architecture": In the section "SSL/TLS Inspection at Scale

" the architecture is described: "Zscaler terminates the user’s connection and opens a new one to the destination... The Zscaler proxy presents a certificate to the user that is signed by the Zscaler root CA." (zscaler.com/resources/white-papers/zscaler-zero-trust-exchange-architecture.pdf

Page 10)

Cloud Application Control is a specific Zscaler feature designed to provide granular control over SaaS applications. It allows administrators to create policies that can differentiate between corporate and personal instances of the same application. This is often achieved through tenant restriction, where Zscaler inserts specific headers into the user's web request, signaling to the SaaS provider which tenant (i.e., the corporate instance) the user is authorized to access. This directly addresses the need to ensure users can only use the sanctioned corporate instance while blocking access to personal or other unauthorized instances.

A. Out-of-band CASB: This solution connects to SaaS applications via APIs to scan data at rest and enforce policies within the app, but it does not control real-time user access to specific instances.

C. URL filtering with SSL inspection: URL filtering operates at the domain level. It is generally insufficient for distinguishing between corporate and personal tenants that often share the same login URL.

D. Endpoint DLP: This technology focuses on preventing sensitive data from leaving the endpoint device; it does not manage or control user login access to different SaaS application instances.

---

1. Zscaler Help Portal

"About Cloud App Control": "The Zscaler service provides Cloud App Control policies that allow you to control the cloud applications that users in your organization can access... Additionally

you can enforce tenant restrictions for certain cloud applications to ensure users can only log in with their corporate accounts."

2. Zscaler Help Portal

"Configuring Tenant Profiles": "You can create tenant profiles for specific cloud applications and then use them in your Cloud App Control policy to enforce tenant restrictions. When you enforce tenant restrictions

you can allow users to access only your organization's corporate accounts for a specific cloud application and block access to their personal accounts."

3. Zscaler Help Portal

"Adding a Cloud App Control Policy Rule": The documentation on creating policy rules explicitly shows the option to apply "Tenant Profiles" as an action for selected cloud applications

which is the mechanism used to enforce access to a specific corporate instance.

Zscaler performs SSL/TLS inspection by acting as a man-in-the-middle (MitM), decrypting traffic, and re-encrypting it with a Zscaler-issued certificate. However, when an administrator configures an SSL Inspection policy rule to exempt or bypass inspection for specific traffic (e.g., for privacy or application compatibility reasons), the Zscaler service does not perform decryption. In this scenario, Zscaler tunnels the encrypted session, and the original SSL/TLS certificate from the destination server is passed directly to the user's browser. The browser then establishes a secure session directly with the server through the Zscaler proxy.

A. Detecting a known threat signature within encrypted traffic requires SSL inspection, where Zscaler would issue its own certificate, not the server's.

B. Web traffic on custom TCP ports is not automatically exempted; it is subject to SSL inspection policies just like standard port traffic.

D. A user's past connection history does not influence the SSL inspection policy, which is evaluated for each new session based on configured rules.

1. Zscaler Help Portal

"About SSL Inspection": In the section describing the process

it states

"When SSL inspection is disabled for traffic

the ZIA Public Service Edge...allows the encrypted traffic to pass through without inspection

and the original server certificate is presented to the user's browser." This directly confirms that exemption policies result in forwarding the server certificate.

2. Zscaler Help Portal

"Configuring SSL Inspection Policy": This document details the policy actions. The "Do Not Inspect" action is defined as the method to "Bypass SSL inspection." This is the specific configuration that triggers the behavior described in the question.

3. Zscaler

"ZIA SSL Inspection Deployment Guide

" Page 6: The guide explains SSL bypasses: "For traffic that is bypassed from decryption

Zscaler simply tunnels the SSL/TLS traffic between the client and the server. The client receives the original server certificate and Zscaler has no visibility into the encrypted tunnel." This reinforces that a bypass policy is the direct cause.

Zscaler Tunnel 2.0 is a proprietary, packet-based tunneling protocol designed to forward all IP traffic from an endpoint to the Zscaler Zero Trust Exchange. This comprehensive approach is not limited to specific ports or application protocols. It encapsulates all TCP and UDP traffic, regardless of the port number, as well as other IP-based protocols like ICMP. This enables the Zscaler cloud to perform deep packet inspection and apply security policies to all user traffic, providing a complete security posture consistent with Zero Trust principles.

A. This is incorrect because Tunnel 2.0 is not limited to specific web ports; it forwards all IP traffic from the device.

B. This is incorrect as it only mentions web and DNS traffic, while Tunnel 2.0 is designed to handle all protocols.

D. This is incorrect because it lists only a subset of protocols, failing to capture the "all ports and protocols" capability of Tunnel 2.0.

1. Zscaler Official Documentation

Help Portal: In the article "About Z-Tunnel 2.0

" it is stated: "Z-Tunnel 2.0 is the default tunneling protocol for Zscaler Client Connector. It is a proprietary tunneling protocol that encapsulates all IP traffic

including TCP

UDP

and ICMP

and forwards it to the Zscaler cloud." (Source: Zscaler Help Portal

"About Z-Tunnel 2.0"

Section: "Z-Tunnel 2.0 Overview").

2. Zscaler Official Documentation

Help Portal: The "Configuring Forwarding Profiles for Zscaler Client Connector" guide specifies the behavior of different forwarding methods. For the "Tunnel" method

which uses Z-Tunnel 2.0

it states: "When you select Tunnel as the forwarding method

Zscaler Client Connector uses Z-Tunnel 2.0 to forward all port and protocol traffic to the Zscaler service." (Source: Zscaler Help Portal

"Configuring Forwarding Profiles for Zscaler Client Connector"

Section: "Windows and macOS Forwarding Options").

Zscaler Identity Threat Detection and Response (ITDR) is designed to provide visibility into an organization's identity attack surface by continuously monitoring Active Directory (AD). To achieve this, the Identity Protection engine directly queries the AD environment. It uses the Lightweight Directory Access Protocol (LDAP), the standard protocol for interacting with directory services like AD. A configured service account with appropriate read-only permissions is used to run these LDAP queries, allowing the engine to discover AD domains and forests and gather detailed information about configurations, users, and groups without relying on network-level scanning or log analysis.

A. Scanning network ports: This is a general network reconnaissance technique and does not provide the specific, detailed object and attribute information from Active Directory that ITDR requires.

C. Analyzing firewall logs: Firewall logs contain information about network traffic, not the internal configuration state, user permissions, or group policies within Active Directory.

D. Packet sniffing: While it could theoretically capture LDAP traffic, this is an inefficient, indirect, and less reliable method compared to making direct, authenticated queries to the directory service.

1. Zscaler Help Portal

"About Identity Protection Profiles": In the description of how the system functions

the documentation states

"The Identity Protection engine discovers your AD domains and forests by running LDAP queries and then assesses the security posture of your AD configuration."

2. Zscaler Help Portal

"Step-by-Step Configuration Guide for Zscaler Identity Threat Detection & Response": In the "Prerequisites" section (specifically

under "Identity Protection Service Account")

it details the requirement for a service account with "read-only permissions to the Active Directory (AD) domain." This requirement exists to facilitate direct

authenticated queries against the domain controllers.