ZDTA flashcards
ZDTA · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Zscaler Zero Trust Exchange
- Cloud-native security platform that connects users and workloads directly to applications through inline policy enforcement, replacing hub-and-spoke network security with identity- and context-based access.
- ZEN (Zscaler Enforcement Node)
- The data-plane node in the Zscaler cloud that inspects traffic and enforces policy closest to the user, providing inline proxy and firewall functions.
- Never trust, always verify
- Zero Trust principle requiring every request to be authenticated and authorized using identity, device posture, and context rather than implicit network location trust.
- Application-level access
- Access model where users are granted rights to a specific application rather than the surrounding network segment, limiting lateral movement after a compromise.
- Zero Trust Branch
- Architecture in which branch traffic is forwarded to the Zero Trust Exchange by Cloud Connector instead of being backhauled to a data center for security inspection.
- First match wins
- ZIA policy evaluation rule: rules are processed top-down and the first rule whose criteria match the traffic determines the action; later rules are ignored.
- SSL Inspection policy
- Determines which traffic ZIA decrypts, based on URL category and other criteria, enabling layer-7 inspection while allowing bypass for compliance-sensitive categories.
- Cloud App Control
- ZIA policy that governs actions inside SaaS applications, such as allowing an app but blocking uploads, posts, or file transfers within it.
- DLP engine
- Combines dictionaries, file-type rules, and confidence thresholds to detect sensitive data; a DLP policy then applies allow, block, or quarantine actions to matches.
- CASB API mode
- Out-of-band CASB deployment that connects to sanctioned SaaS APIs to scan data at rest for DLP violations, malware, and configuration risks.
- Sandbox detonation
- ZIA sends unknown or suspicious files to an isolated environment for behavioral analysis, and the resulting verdict updates ATP policy enforcement.
- App Connector
- ZPA component deployed near internal applications that opens outbound TLS connections to the ZPA cloud, so no inbound firewall ports are required.
- Application Segment
- Defines a specific internal application by domain, IP address, and port; ZPA policy and Client Connector forwarding use it to identify the app.
- Segment Group
- A collection of application segments used to simplify access policy so that one rule can grant access to several related applications at once.
- Inside-out connection
- ZPA connectivity model where App Connectors initiate outbound connections to the cloud, removing the need to expose internal applications to inbound internet traffic.
- Microtunnel
- Encrypted per-application tunnel established by Client Connector to the ZPA cloud and then to the App Connector, carrying only authorized application traffic.
- Browser Access
- Clientless ZPA capability that lets users reach internal web applications through a browser without installing Client Connector, applying the same access policy.
- ZDX Score
- A 0–100 composite metric of end-user experience combining device health, network quality, and application performance; lower values indicate degraded experience.
- CloudPath
- ZDX hop-by-hop analysis that traces the network path from user to application and attributes latency or loss to the local network, ISP, or Zscaler cloud.
- Deep Trace
- ZDX diagnostic capture that records detailed path and packet-level data for a specific user session to troubleshoot intermittent or complex experience issues.
- Web probe
- Synthetic test that ZDX runs continuously from Client Connector to internet and SaaS destinations to measure availability and response time.
- ZDX alert threshold
- A configured limit on metrics such as latency, packet loss, or score drop that triggers a notification or webhook when the limit is breached.
- Z-Tunnel 2.0
- Client Connector tunnel using DTLS/TLS that forwards endpoint traffic to the nearest ZEN and supports DLP, TLS inspection, and full layer-7 policy.
- App Profile
- Client Connector configuration object that binds a forwarding profile, device posture profile, and other settings, and is assigned to users or groups.
- Trusted Network
- A network defined in Client Connector policy where tunneling is disabled because the endpoint is considered to be on a trusted corporate network.
- Surrogate IP
- ZIA feature that preserves user identity for tunneled or NATed traffic by inserting the user IP in X-Forwarded-For headers for policy and reporting.
- Cloud Connector
- Auto-scaling virtual appliance in AWS, Azure, or GCP that forwards branch or VPC traffic to the Zscaler cloud without on-premises proxy hardware.
- RBAC admin role
- Role-based access control assigns permissions such as Super Admin, Policy Admin, or Auditor to administrators, enforcing least privilege in the admin portal.
- Activation
- ZIA step that commits pending configuration changes to the live cloud; edits are not enforced until an administrator performs activation.
- Admin Audit Log
- Record of every administrative configuration change including admin identity, timestamp, and old and new values, used for compliance and troubleshooting.
- Cloud NSS
- Nanolog Streaming Service capability that streams Zscaler logs to a SIEM or syslog destination for correlation, retention, and security monitoring.
- OneAPI
- OAuth2-based programmatic interface that provides unified access to Zscaler product APIs for automation, reporting, and configuration management.