ZDTA cheat sheet

Zero Trust model: no implicit trust from network location; every request is authenticated and authorized using identity, device posture, and context.

Zscaler Zero Trust Exchange is a cloud-native SSE platform delivering ZIA, ZPA, ZDX, and Cloud Connector as services with no on-premises proxy appliances.

Design principle is 'connect users to applications, not networks' - ZPA replaces network-level VPN access with per-application access.

Enforcement happens inline at the ZEN (Zscaler Enforcement Node) closest to the user, so policy follows the user rather than the data center.

Policy inputs include SAML identity, SCIM group membership, device posture, location, destination application, and content context.

Layer-7 enforcement requires decryption; the SSL Inspection policy defines which traffic is decrypted and which categories bypass inspection.

Zero Trust Branch forwards branch traffic to the Zero Trust Exchange via Cloud Connector instead of backhauling to a data center.

Traffic can reach the platform via Client Connector, PAC file, GRE/IPSec tunnel, Cloud Connector, or Private Service Edge.

ZIA is an inline cloud proxy inspecting HTTP/HTTPS and applying URL Filtering, Cloud Firewall, IPS, ATP, Sandbox, DLP, and CASB in one policy path.

ZIA rules evaluate top-down with first-match-wins semantics; specific allow/block rules must sit above broad catch-all rules.

SSL Inspection policy selects traffic to decrypt by URL category and other criteria; financial, health, and legal categories are commonly bypassed for compliance.

DLP requires three components working together: dictionaries, a DLP engine with confidence thresholds, and a DLP policy that sets the action.

Cloud App Control governs in-app actions (for example allow sign-in but block upload, post, or file transfer) rather than only blocking the whole app.

CASB inline mode covers sanctioned and unsanctioned SaaS in the traffic path; CASB API mode scans data at rest in sanctioned apps out-of-band.

Sandbox detonates unknown or suspicious files in an isolated environment; resulting verdicts feed ATP policy enforcement.

Cloud Firewall enforces layer-3/layer-4 rules on source, destination, and port; IPS applies exploit and vulnerability signatures to allowed flows.

File Type Control and Bandwidth Control restrict risky or high-volume transfers by file type and by traffic class.

ZPA uses inside-out connectivity: App Connectors open outbound TLS to the ZPA cloud, so no inbound firewall ports are opened for internal applications.

An Application Segment defines one internal app by domain, IP address, and port; Segment Groups bundle segments so one policy rule covers related apps.

ZPA access policy evaluates user/group, SAML attributes, device posture, and the requested application for each connection request.

Client Connector intercepts DNS resolution for the application domain and forwards matching traffic through a microtunnel to the correct App Connector.

App Connectors should be deployed in pairs or groups close to the application, one group per data center, to provide high availability and low latency.

Applications are never exposed to the internet; users receive application-level access rather than network-level access, limiting lateral movement.

Browser Access provides clientless access to internal web applications through the ZPA cloud while applying the same access policy.

Privileged Remote Access (PRA) adds session recording and credential vaulting for privileged administrative sessions.

Place specific block or deny rules above broad allow rules, because ZPA access policy is order-dependent.

ZDX measures end-user digital experience end-to-end from the Client Connector on the endpoint through the network to the destination application.

The ZDX Score is a 0–100 composite of device health, network quality, and application performance; a lower score means worse user experience.

CloudPath performs hop-by-hop path analysis to attribute latency or packet loss to the local network, the ISP, or the Zscaler cloud.

Web probes test internet and SaaS destinations continuously; application probes cover internal applications, including ZPA-delivered apps.

User-level ZDX telemetry requires Client Connector with ZDX enabled; without the connector there is no endpoint or path data for that user.

Alerts fire when configured thresholds such as latency, packet loss, or score drop are breached and can send webhooks to Slack, Teams, or ServiceNow.

Deep Trace captures detailed path and packet-level data for a specific user session to diagnose intermittent or complex issues.

ZDX correlates Wi-Fi signal strength, device CPU/memory, and network hops to isolate whether the root cause is device, network, or application.

Client Connector forwards endpoint traffic to the nearest ZEN using Z-Tunnel 2.0, which rides DTLS/TLS and supports DLP and full TLS inspection.

Z-Tunnel 1.0 uses HTTP CONNECT and lacks some DLP and inspection capabilities; Z-Tunnel 2.0 is the preferred forwarding method.

An App Profile binds a Forwarding Profile (forwarding rules, PAC behavior) with a Device Posture profile and is assigned to users or groups.

Trusted Networks disable tunneling when the endpoint is on a defined corporate network, avoiding unnecessary hairpinning.

Enrollment uses provisioning keys or the user portal; the connector registers the device and associates it with the authenticated user identity.

Forwarding options are Client Connector, PAC file, GRE tunnel, IPSec VPN, Cloud Connector, and Private Service Edge.

GRE and IPSec forwarding are location-based; the tunnel source IP must be configured as a Location in the ZIA admin portal.

Surrogate IP preserves user identity for tunneled or NATed traffic by inserting the user IP in X-Forwarded-For for policy and reporting.

Cloud Connector is an auto-scaling VM in AWS, Azure, or GCP that forwards branch or VPC traffic to Zscaler without on-premises proxy hardware.

RBAC assigns roles such as Super Admin, Policy Admin, and Auditor; grant the minimum role needed for each administrator's duties.

ZIA configuration changes stay pending until an administrator performs Activation; unactivated edits are not enforced in the cloud.

The Admin Audit Log records each configuration change with administrator identity, timestamp, and old and new values.

Log streaming to a SIEM uses Cloud NSS or the Nanolog Streaming Service and is configured per log type (web, firewall, DLP, etc.).

OneAPI uses OAuth2 to give unified programmatic access to Zscaler product APIs; the Terraform provider manages configuration as code.

Roll out policy changes to a pilot user group first, then broaden scope, keeping rules ordered specific-to-general.

Interactive Insights, Executive Insights, and scheduled reports cover web usage, security events, and application trends for stakeholders.

SAML IdP integration combined with SCIM provisioning keeps user and group data current so policy references valid identities.