I85PREP
⌘ K
ZDTA study materials
ZDTA study resources

ZDTA practice questions

One question at a time. Build your ZDTA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Zero Trust Architecture and the Zscaler Zero Trust Exchange

Which Zscaler cloud service delivers inline inspection of internet and SaaS traffic to users no matter where they are located?

  1. Zscaler Workload Segmentation
  2. Zscaler Internet Access Correct answer.
  3. Zscaler Private Access
  4. Zscaler Digital Experience

Explanation

Zscaler Internet Access is the secure web gateway service that inspects and applies policy to user traffic destined for the internet and sanctioned SaaS applications. It sits inline in the cloud, so the same policy follows a user at headquarters, at home, or on a mobile network. The other services in the Zero Trust Exchange cover private application access, experience monitoring, and workload protection.

Question 2Zero Trust Architecture and the Zscaler Zero Trust Exchange

Which Zscaler service brokers user connections to internal applications without publishing those applications to the internet?

  1. Zscaler Internet Access
  2. Zscaler Cloud Sandbox
  3. Zscaler Cloud Firewall
  4. Zscaler Private Access Correct answer.

Explanation

Zscaler Private Access is the zero trust network access service: applications stay hidden behind an outbound-only connector and users reach them through the Zscaler cloud. Access is granted per application after identity and posture checks rather than by network reachability. The other options are components of internet security, malware analysis, or Layer 3/4 filtering.

Question 3Zero Trust Architecture and the Zscaler Zero Trust Exchange

Which statement captures the core principle of a zero trust architecture?

  1. Access is granted per request after verifying identity and context Correct answer.
  2. Only traffic that leaves the data center is subject to policy checks
  3. Internal networks are trusted while external networks are untrusted
  4. Trust is granted to a user once their password is validated at login

Explanation

Zero trust removes the assumption that a location or network implies trust and instead evaluates each request on identity, device, and context before granting access. Verification is continuous, so a session that becomes risky can lose access. This contrasts with perimeter models that treat everything inside the network as inherently trustworthy.

Question 4Zero Trust Architecture and the Zscaler Zero Trust Exchange

What is the role of Zscaler Client Connector on an endpoint?

  1. It forwards the endpoint's traffic to the nearest Zscaler service edge Correct answer.
  2. It assigns static public IP addresses to roaming users
  3. It caches corporate web content locally for offline browsing
  4. It replaces the endpoint's installed antivirus engine with cloud-based malware scanning

Explanation

Client Connector is the lightweight agent that steers endpoint traffic to the Zscaler cloud, where identity-based policy is enforced. Because the tunnel originates from the endpoint, the user receives the same protection on any network without a VPN. It does not provide content caching or address assignment.

Question 5Zero Trust Architecture and the Zscaler Zero Trust Exchange

How does a Zscaler App Connector establish its link with the Zscaler cloud?

  1. It listens on a public IP address and accepts inbound connections from remote users
  2. It requires a static one-to-one NAT rule on the perimeter firewall
  3. It opens outbound connections from inside the network to the Zscaler cloud Correct answer.
  4. It relies on a site-to-site VPN between the branch and the data center

Explanation

App Connectors initiate outbound-only connections to the Zscaler service edge, and user sessions are relayed down those connections. Because nothing listens on an inbound port, no firewall pinhole, public IP, or NAT rule is required to publish the application. This is what allows applications to remain invisible to the internet.

Question 6Zero Trust Architecture and the Zscaler Zero Trust Exchange

What does Zscaler Cloud Sandbox do with a file that has no known verdict?

  1. Returns the file to the user along with a warning banner explaining the risk
  2. Detonates it in an isolated environment and observes its behavior Correct answer.
  3. Blocks it permanently and quarantines the sender's mailbox
  4. Forwards it to the endpoint for local static analysis

Explanation

Files without an existing verdict are executed in an isolated sandbox where behavior such as file system changes, registry writes, and network callbacks is observed. A verdict is then produced and used by policy to allow or block the file. This protects users from previously unseen malware that signature matching would miss.

Question 7Zero Trust Architecture and the Zscaler Zero Trust Exchange

Why does Zscaler perform SSL/TLS inspection on outbound traffic?

  1. To convert HTTPS traffic into HTTP for faster page rendering
  2. To compress encrypted content and reduce bandwidth costs
  3. To decrypt traffic so policy can be applied to the payload, then re-encrypt it Correct answer.
  4. To terminate user sessions so that passwords can be captured and stored centrally for auditing

Explanation

Without decryption, a gateway can see only the destination, so payload-based controls such as data loss prevention, malware scanning, and file-type rules cannot operate. SSL inspection breaks the session, inspects the content, applies policy, and re-encrypts before delivery. It is not used to harvest credentials or downgrade protocols.

Question 8Zero Trust Architecture and the Zscaler Zero Trust Exchange

How does Zscaler typically authenticate users so that policy can be applied per person?

  1. By brokering authentication with the identity provider using SAML Correct answer.
  2. By issuing a shared local client certificate to every device in a department
  3. By mapping each user to a fixed public IP address
  4. By requiring every user to connect through a VPN concentrator hosted at each site

Explanation

Zscaler federates with the organization's identity provider so the authenticated user identity, not a shared address, becomes the basis for policy. Directory groups and attributes are consumed so rules can target users and groups directly. Shared IP addresses cannot distinguish individuals behind the same egress point.

Question 9Zero Trust Architecture and the Zscaler Zero Trust Exchange

In Zscaler Private Access, what does an application segment define?

  1. The DNS resolver used by the App Connector at each site
  2. The applications and the users or groups allowed to reach them Correct answer.
  3. The list of IP addresses that are excluded from SSL inspection
  4. The maximum bandwidth quota that is assigned to each branch location

Explanation

An application segment describes a protected internal application, including the servers, ports, and the user groups entitled to it. Policy is written against these segments, which is how ZPA enforces least privilege at the application level instead of by subnet. Once defined, access is brokered per segment after identity and posture checks.

Question 10Zero Trust Architecture and the Zscaler Zero Trust Exchange

Which mechanism keeps a ZPA-published application's ports invisible to unauthenticated scanners?

  1. Rate limiting applied at the perimeter firewall
  2. A captive portal that challenges every TCP SYN
  3. A public DNS record that resolves only for enrolled corporate devices
  4. Single Packet Authorization validated before any port opens Correct answer.

Explanation

With Single Packet Authorization, the client first proves its identity with a single authenticated packet, and only then is a path established. A scanner probing the application receives no response at all, so the service appears nonexistent. This is how ZPA achieves application cloaking rather than port-based exposure.

Question 11Zero Trust Architecture and the Zscaler Zero Trust Exchange

A company wants one client to apply policy to general web and SaaS traffic while also brokering access to privately hosted applications. Which pairing fits?

  1. Zscaler Internet Access for web traffic and Zscaler Private Access for internal apps Correct answer.
  2. Zscaler Deception for web traffic and ZDX for internal apps
  3. Zscaler Digital Experience for web traffic and Zscaler Cloud Sandbox for internal apps
  4. Zscaler Cloud Connector for web traffic and Zscaler Deception for internal apps

Explanation

Internet security and private application access are separate services that share the same client and cloud. Zscaler Internet Access inspects web and SaaS traffic, while Zscaler Private Access brokers per-application access to internal systems. Deception, experience monitoring, and sandboxing are supporting capabilities, not the access path.

Question 12Zero Trust Architecture and the Zscaler Zero Trust Exchange

A branch office has no Client Connector deployed but must send all internet traffic to Zscaler. Which forwarding method suits this site?

  1. GRE or IPSec tunnel from the branch router Correct answer.
  2. Z-Tunnel 2.0 running from the endpoint agent on each laptop
  3. A DNS forwarding zone configured on the local domain controller
  4. A PAC file that is pushed out through Active Directory group policy

Explanation

Locations without an agent are onboarded by configuring the edge router to tunnel traffic to the nearest Zscaler service edge using GRE or IPSec. All devices behind that router are then covered without per-endpoint software. PAC files and Z-Tunnel depend on configuration or software on the endpoint itself.

Question 13Zero Trust Architecture and the Zscaler Zero Trust Exchange

Which Zscaler Internet Access capability enforces Layer 3 and Layer 4 rules across all ports and protocols rather than only web ports?

  1. Cloud Firewall Correct answer.
  2. Cloud App Control
  3. Content filtering policy
  4. Cloud Sandbox

Explanation

Cloud Firewall provides Layer 3 and Layer 4 filtering for any port and protocol carried through the Zscaler cloud, including non-web traffic from agent-forwarded users and locations. Cloud App Control governs application-layer use of specific services, and content filtering governs categories of web destinations. Together they extend policy beyond HTTP and HTTPS.

Question 14Zero Trust Architecture and the Zscaler Zero Trust Exchange

What distinguishes the API-based CASB mode from inline inspection for a sanctioned SaaS application?

  1. It decrypts TLS sessions between the browser and the SaaS provider
  2. It blocks the SaaS application for all users until an exception is approved
  3. It inspects traffic in real time as users upload files
  4. It uses the application's own APIs to scan data at rest out of band Correct answer.

Explanation

API-based CASB connects directly to the sanctioned application's programming interfaces and inventories data that already resides in the tenant, such as files shared publicly. It provides visibility and remediation for stored content but does not sit in the user's data path. Inline inspection, by contrast, sees traffic in motion and can block an action in real time.

Question 15Zero Trust Architecture and the Zscaler Zero Trust Exchange

Which control ensures that only endpoints meeting security requirements can reach a sensitive internal application through Zscaler Private Access?

  1. A bandwidth policy applied to each App Connector during peak hours
  2. A device posture profile evaluated before access is allowed Correct answer.
  3. A DNS sinkhole configured on the App Connector
  4. A static route that is added to the branch router

Explanation

Device posture profiles collect signals such as OS version, disk encryption, and endpoint protection status from Client Connector and evaluate them against the access policy. If the device does not comply, the application segment is not reachable even for an authenticated user. This ties access to device health rather than identity alone.

Question 16Zero Trust Architecture and the Zscaler Zero Trust Exchange

Which plane of the Zscaler architecture processes user traffic and applies the enforcement policy?

  1. The management plane
  2. The control plane
  3. The data plane Correct answer.
  4. The identity plane

Explanation

The data plane consists of the service edges that receive user traffic and enforce policy on it. The control plane distributes configuration and policy decisions, while the management plane hosts the administrative interface where policy is authored. Separating these functions lets the data plane scale horizontally in each region.

Question 17Zero Trust Architecture and the Zscaler Zero Trust Exchange

Which capability lets an organization stream Zscaler transaction logs to its SIEM for correlation with other security data?

  1. Cloud Sandbox reporting
  2. Nanolog Streaming Service Correct answer.
  3. Cloud Connector auto-provisioning
  4. App Connector health checks

Explanation

Nanolog Streaming Service delivers web, firewall, and other transaction logs from the Zscaler cloud to an on-premises or cloud SIEM in near real time. Analysts can then correlate Zscaler events with identity, endpoint, and other telemetry. The other options relate to file analysis and connector operations rather than log export.

Question 18Zero Trust Architecture and the Zscaler Zero Trust Exchange

Which Zscaler service measures hop-by-hop network paths and device health to explain a user's poor application experience?

  1. Zscaler Private Access
  2. Zscaler Digital Experience Correct answer.
  3. Zscaler Deception
  4. Zscaler Cloud Firewall

Explanation

Zscaler Digital Experience collects measurements from the endpoint and from Zscaler service edges to isolate where latency or failure occurs, whether on the local network, the ISP path, or the application itself. It correlates device health with application performance so help desks can find root cause quickly. The other services handle access, filtering, and decoys.

Question 19Zero Trust Architecture and the Zscaler Zero Trust Exchange

How does Zscaler Deception support a zero trust strategy?

  1. It blocks access to newly registered domains at the secure web gateway
  2. It plants decoy resources that alert when an intruder touches them Correct answer.
  3. It encrypts all east-west traffic between workloads
  4. It replaces the need for multi-factor authentication

Explanation

Deception distributes decoy credentials, shares, and services that legitimate users have no reason to access. Any interaction is a high-fidelity signal of intruder activity, giving defenders early warning of reconnaissance or lateral movement. It complements, rather than replaces, authentication and filtering controls.

Question 20Zero Trust Architecture and the Zscaler Zero Trust Exchange

Why is a remote user's traffic no longer backhauled to a central data center when the organization uses the Zscaler Zero Trust Exchange?

  1. Because Zscaler replicates each customer's policy to a single regional hub
  2. Because users are required to connect through a VPN first
  3. Because traffic is sent to the nearest service edge in a shared cloud Correct answer.
  4. Because each branch runs its own full Zscaler appliance

Explanation

Zscaler operates a multi-tenant cloud with service edges in many locations, and policy is enforced at the edge closest to the user. Traffic therefore exits to the internet near the user instead of traversing a hub. This removes the latency and capacity penalties of traditional hub-and-spoke backhaul.

Question 21Zero Trust Architecture and the Zscaler Zero Trust Exchange

In a Zscaler Private Access deployment, which statement correctly describes the path of a user opening an internal application?

  1. The client opens a direct TLS connection to the App Connector's public IP address
  2. The App Connector dials the user's endpoint after resolving its hostname
  3. The user's traffic is routed through the branch IPSec tunnel and never reaches the Zscaler cloud at all
  4. The client tunnels to the Zscaler cloud, which relays over the connector's outbound connection Correct answer.

Explanation

Client Connector builds a tunnel to the Zscaler service edge, and the App Connector maintains its own outbound connection to that same edge. The cloud joins the two, so the user is authorized per application and the internal server only ever sees the connector. Neither side initiates an inbound connection to the other.

Question 22Zero Trust Architecture and the Zscaler Zero Trust Exchange

Which statement about Z-Tunnel 2.0 is accurate?

  1. It replaces the need for an identity provider integration
  2. It carries only UDP traffic and cannot tunnel TCP sessions
  3. It multiplexes several TCP tunnels over one HTTP CONNECT connection Correct answer.
  4. It requires a machine certificate installed on the perimeter firewall appliance

Explanation

Z-Tunnel 2.0 uses an HTTP CONNECT method over TLS and multiplexes multiple micro-tunnels within a single connection, which reduces overhead and improves resilience on lossy networks. UDP traffic can be carried in parallel using DTLS. Identity still comes from the identity provider integration, not from the tunnel itself.

Question 23Zero Trust Architecture and the Zscaler Zero Trust Exchange

Which design goal is achieved by giving Zscaler Private Access App Connectors no listening ports on the internal network?

  1. It guarantees that the connector can decrypt all TLS traffic
  2. It removes the need to authenticate users at the application layer
  3. It lets any internal host reach the connector over the flat management VLAN segment
  4. It shrinks the internal attack surface because nothing listens for inbound connections Correct answer.

Explanation

A connector that only makes outbound connections presents no service for an attacker to scan, probe, or exploit, and it needs no firewall pinhole. This extends the cloaking model inward as well as outward. Authentication and authorization remain enforced by policy at the Zscaler cloud.

Question 24Zero Trust Architecture and the Zscaler Zero Trust Exchange

What is the effect of enabling customer-managed keys for end-to-end encryption in Zscaler Private Access?

  1. The App Connector caches user credentials to speed up re-authentication
  2. The Zscaler service edge terminates TLS for every session and stores the plaintext for later inspection
  3. The user's identity provider issues certificates to the internal application
  4. The payload stays encrypted end to end, so the Zscaler cloud relays it without decrypting Correct answer.

Explanation

End-to-end encryption keeps the payload encrypted between Client Connector and App Connector using keys the customer controls, so the Zscaler cloud forwards the session without reading its contents. This satisfies organizations that cannot permit a third party to see application data in the clear. Brokered access, identity checks, and policy still apply to the session metadata.

Question 25Zero Trust Architecture and the Zscaler Zero Trust Exchange

An organization wants to move from subnet-based access control to per-application least privilege. Which approach best reflects the zero trust model in the Zscaler Zero Trust Exchange?

  1. Define application segments and grant access by user group and device posture Correct answer.
  2. Assign static IP addresses per user and permit access by source IP address
  3. Grant all authenticated users access to the entire data center subnet and log the sessions
  4. Place each application in its own VLAN and route between VLANs with a firewall

Explanation

Zero trust grants the minimum access needed for a specific application, decided from user identity, group membership, and device state at the moment of the request. Application segments make that granularity explicit instead of inferring entitlement from network position. Logging broad access after the fact does not reduce the granted privilege.

Question 26Zero Trust Architecture and the Zscaler Zero Trust Exchange

Which statement captures the core premise of a Zero Trust architecture?

  1. Trust is based on the reputation of the source IP address range.
  2. Trust is granted per request after identity and context are verified. Correct answer.
  3. Trust is inherited from the corporate network once a device is on the LAN.
  4. Trust is granted at login and stays valid for the rest of the session.

Explanation

Zero trust removes implicit trust derived from network location; each request is evaluated against identity, device state and context before access is allowed. There is no durable trust state that persists simply because a login succeeded. This is why the model is often summarized as never trust, always verify.

Question 27Zero Trust Architecture and the Zscaler Zero Trust Exchange

Within the Zscaler Zero Trust Exchange, which pairing correctly describes the primary purpose of ZIA and ZPA?

  1. ZIA provides endpoint antivirus; ZPA provides inbound email filtering.
  2. ZIA secures private applications; ZPA secures internet and SaaS traffic for all users.
  3. ZIA and ZPA both require site-to-site VPN tunnels to the nearest data center.
  4. ZIA secures internet and SaaS traffic; ZPA secures private applications. Correct answer.

Explanation

Zscaler Internet Access is the secure web gateway service that inspects user traffic to the internet and sanctioned or unsanctioned SaaS. Zscaler Private Access is the zero trust network access service that brokers connections to internal applications. They are separate services on a shared cloud platform with a common policy intent.

Question 28Zero Trust Architecture and the Zscaler Zero Trust Exchange

Where is policy enforcement performed for a user working from a coffee shop on a Zscaler deployment?

  1. Locally on the user's endpoint by the Client Connector's full inspection engine.
  2. In the nearest Zscaler cloud enforcement node that the user connects to. Correct answer.
  3. At the organization's headquarters data center after backhauling.
  4. On a physical appliance installed in the user's home office.

Explanation

The Zero Trust Exchange is a cloud-delivered platform, so a roaming user is steered to the closest enforcement node of the global Zscaler cloud where policy is applied. No on-premises appliance is needed and traffic is not hauled back to a central site. This proximity is what keeps inspection consistent for users wherever they work.

Question 29Zero Trust Architecture and the Zscaler Zero Trust Exchange

Which statement best explains why Zscaler can enforce URL filtering and file inspection on a user's HTTPS request?

  1. It relies on DNS answers alone to decide which content is allowed.
  2. It passively copies packets at the ISP and analyzes them after delivery.
  3. It reads only the server certificate name during the TLS handshake.
  4. It terminates the user's connection and inspects the request itself. Correct answer.

Explanation

In a full proxy architecture the user's session ends at the enforcement node, which inspects the request, applies policy, and opens its own connection to the destination. That terminating position is what enables content-level controls such as URL category enforcement and file scanning. Metadata-only or passive approaches cannot block on content.

Question 30Zero Trust Architecture and the Zscaler Zero Trust Exchange

An organization must give contractors on unmanaged laptops access to an internal web application without installing any software on those laptops. Which ZPA capability fits?

  1. Browser Access, which proxies the internal web app through Zscaler. Correct answer.
  2. A PAC file on each laptop that forwards private IP ranges to an App Connector.
  3. An IPsec VPN from each contractor laptop to the data center firewall.
  4. A GRE tunnel from each contractor's home router to the nearest Zscaler data center.

Explanation

Browser Access lets a user reach an internal web application through a standard browser, with identity-based policy enforced in the Zscaler cloud and no client software on the endpoint. The application itself is never exposed to inbound connections. Non-web protocols would still require the Client Connector.

Question 31Zero Trust Architecture and the Zscaler Zero Trust Exchange

A team runs workloads in a public cloud VPC and wants their outbound traffic inspected by ZIA and internal apps brokered by ZPA without exposing inbound ports. Which component is designed for this?

  1. An internet-facing load balancer placed in front of the VPC.
  2. A ZPA App Connector installed on each user's laptop.
  3. Zscaler Cloud Connector, which connects outbound to the Zscaler cloud. Correct answer.
  4. Zscaler Deception decoy sensors deployed in the VPC.

Explanation

Cloud Connector provides an outbound-only link from cloud workloads into the Zero Trust Exchange, so workload traffic can be inspected by ZIA and private access can be brokered by ZPA without inbound firewall openings. App Connectors serve private applications for users, while Cloud Connector serves cloud workloads.

Question 32Zero Trust Architecture and the Zscaler Zero Trust Exchange

Leadership wants to know which unsanctioned SaaS applications employees actually use and how risky each one is. Which Zscaler capability addresses this directly?

  1. Cloud Sandbox detonation of every file a user downloads to look for malware.
  2. Cloud App Catalog data that rates the SaaS apps users are actually using. Correct answer.
  3. The ZPA App Connector health dashboard showing connector reachability.
  4. Deception decoys placed in the server VLAN to attract intruders.

Explanation

ZIA sees the SaaS destinations present in user traffic, and the Cloud App Catalog supplies enterprise risk attributes such as security, compliance and data-sharing posture. Combining the two reveals shadow IT in use and lets the organization prioritize which apps to sanction, restrict or coach on.

Question 33Zero Trust Architecture and the Zscaler Zero Trust Exchange

Which difference best explains why Zscaler Private Access limits lateral movement compared with a traditional remote-access VPN?

  1. ZPA applies policy only to web ports, so other protocols are blocked by default.
  2. ZPA requires users to connect to the corporate LAN before any access is granted.
  3. ZPA encrypts all user traffic, while a traditional VPN sends traffic in clear text.
  4. ZPA authorizes each app individually rather than placing users on a subnet. Correct answer.

Explanation

A VPN typically extends the network to the device, so the device can reach anything the network permits once connected. ZPA authenticates the user and authorizes a specific application, connecting only that application, so a compromised endpoint cannot roam other internal hosts. Access is scoped to the application rather than to an address range.

Question 34Zero Trust Architecture and the Zscaler Zero Trust Exchange

An administrator wants to block attempts to upload customer account numbers into unsanctioned web forms. Which Zscaler control is designed for this?

  1. Deception alerts generated by decoy credentials.
  2. Inline data loss prevention inspected in ZIA on the outbound request. Correct answer.
  3. ZPA App Connector segmentation of the internal finance subnet.
  4. Cloud Sandbox verdict sharing with the SIEM.

Explanation

Inline DLP examines the content of the outbound request as it passes through the ZIA enforcement node and can block or coach on sensitive data patterns before the data leaves the organization. Because it sits in the data path, it can act in real time on form submissions and file uploads.

Question 35Zero Trust Architecture and the Zscaler Zero Trust Exchange

Which statement best explains how continuous telemetry from the Zero Trust Exchange supports an assume-breach posture?

  1. It replaces the need for an identity provider by scoring each user once per quarter.
  2. It continuously supplies behavioral evidence so trust decisions can be revisited. Correct answer.
  3. It blocks all traffic from any user whose risk score is above zero.
  4. It proves trust at login time, allowing later requests to be approved automatically.

Explanation

Assume-breach means trust is never final, so the platform must keep watching rather than decide once. Transaction logs, digital experience telemetry and risk analytics expose anomalous behavior so policy can be tightened or a session challenged. That ongoing evidence loop is what makes continuous verification operational rather than theoretical.

Question 36Zero Trust Architecture and the Zscaler Zero Trust Exchange

A data center team segments applications with VLANs and firewall rules keyed to server IP addresses. Which limitation is most directly addressed by publishing each application through ZPA?

  1. IP-and-subnet rules drift as workloads move and grant more reach than per-app access. Correct answer.
  2. VLAN segmentation requires every user to install a hardware token.
  3. Firewall rules cannot be logged or audited by the security team, so segmentation is unverifiable.
  4. VLANs cannot carry encrypted traffic between servers.

Explanation

Identity-based, per-application authorization does not depend on where the workload sits, so address churn in virtualized and cloud environments does not create stale or overly permissive rules. Access is scoped to a single application instead of an address range. This narrows reachability in a way address-keyed rules cannot sustain.

Question 37Zscaler Internet Access (ZIA): policy, security and data protection

A ZIA URL Filtering policy contains several rules. How does the service decide which rule applies to a given request?

  1. It applies the rule with the highest numeric priority value.
  2. It applies the last matching rule in the policy list.
  3. It applies every matching rule and merges their actions.
  4. It applies the first rule, from top to bottom, whose criteria match the request. Correct answer.

Explanation

ZIA evaluates URL Filtering rules in the order they appear, top to bottom, and enforces the action of the first rule whose criteria match the transaction. Once a match occurs, no further URL Filtering rules are evaluated. Rule position therefore controls precedence.

Question 38Zscaler Internet Access (ZIA): policy, security and data protection

What is the primary purpose of the Cloud App Control policy in ZIA?

  1. To scan downloaded files for zero-day exploits
  2. To assign bandwidth limits to each application
  3. To allow, block, caution, or isolate use of web applications by category or by app Correct answer.
  4. To decrypt TLS sessions for content inspection

Explanation

Cloud App Control governs whether users may use specific web applications or entire application categories, with actions such as Allow, Block, Caution, and Isolate. It complements URL Filtering by acting on the application rather than only on the URL category.

Question 39Zscaler Internet Access (ZIA): policy, security and data protection

Which component defines the sensitive data patterns that a ZIA DLP rule uses to detect content?

  1. A bandwidth control class assigned to the user
  2. A sandbox profile configured to quarantine
  3. An allow rule in the firewall filtering policy
  4. A DLP engine containing dictionaries, patterns, and thresholds Correct answer.

Explanation

A DLP engine is the reusable object that holds the detection logic, such as dictionaries, regular expressions, and match thresholds. DLP rules reference an engine and add scope, direction, and action. Without an engine, a rule has nothing to match against.

Question 40Zscaler Internet Access (ZIA): policy, security and data protection

What must be present on user endpoints so that ZIA can inspect HTTPS traffic without generating certificate warnings?

  1. The Zscaler root certificate must be trusted in the endpoint's certificate store Correct answer.
  2. The endpoint must run the Zscaler Client Connector in tunnel mode
  3. The endpoint must reach ZIA through a PAC file rather than GRE
  4. The endpoint must be joined to the same domain as the ZIA tenant

Explanation

During SSL inspection, ZIA presents a certificate signed by the Zscaler root CA for the requested site. Browsers warn about this unless they trust that root CA. Distributing the Zscaler root certificate to endpoint trust stores is therefore a prerequisite for warning-free inspection.

Question 41Zscaler Internet Access (ZIA): policy, security and data protection

What does ZIA Sandbox do with a file downloaded by a user?

  1. It detonates the file in an isolated environment and blocks it if malicious behavior is observed Correct answer.
  2. It removes macros from office documents before delivery
  3. It re-encrypts the file with the organization's data protection keys
  4. It caches the file at the nearest data center for faster delivery

Explanation

Sandbox executes suspicious files in an isolated, instrumented environment and observes their behavior. If the file exhibits malicious actions, ZIA blocks the download. This catches unknown threats that signature-based inspection may miss.

Question 42Zscaler Internet Access (ZIA): policy, security and data protection

ZIA Cloud Firewall filtering rules match on which set of criteria?

  1. HTTP header, cookie, and user-agent string
  2. Source and destination address, port, service, user, and location Correct answer.
  3. URL category, cloud app name, and file type
  4. DLP engine match and dictionary weight

Explanation

The Cloud Firewall operates at layers 3 and 4, so its rules match on addresses, ports, network services, and identity attributes such as user and location. It can also match on destination domain names. Content attributes such as URL category or file type belong to other policy types.

Question 43Zscaler Internet Access (ZIA): policy, security and data protection

A ZIA File Type Control rule can block a transfer based on which characteristic?

  1. The TLS cipher suite used to deliver the file
  2. The reputation score of the server hosting the file
  3. The file extension or MIME type of the transfer Correct answer.
  4. The number of pages contained in a PDF

Explanation

File Type Control inspects the file's extension and MIME type to decide whether a transfer is permitted. Administrators can allow or block individual types or groups of related types. It is independent of the site's reputation or the encryption used.

Question 44Zscaler Internet Access (ZIA): policy, security and data protection

What does the ZIA DNS Control policy let an administrator do?

  1. Apply DLP inspection to DNS query payloads
  2. Resolve all domains through the Zscaler anycast network
  3. Allow or block resolution of domains for selected users and locations Correct answer.
  4. Cache DNS responses at the branch for faster lookups

Explanation

DNS Control applies allow and block actions to domain names at the DNS layer, scoped by criteria such as user and location. A blocked domain cannot be resolved, so the connection never reaches the destination. This adds a control point independent of HTTP inspection.

Question 45Zscaler Internet Access (ZIA): policy, security and data protection

A user uploads a file to a cloud storage application. URL Filtering allows the application category, and a DLP rule with the action Block matches the file content. What is the outcome?

  1. The upload is redirected to Sandbox before DLP is evaluated
  2. The upload is allowed because URL Filtering matched first and stops evaluation
  3. The upload is blocked because DLP is enforced on traffic that URL Filtering allowed Correct answer.
  4. The upload is allowed but logged only, since the DLP rule action is Block

Explanation

URL Filtering and DLP are separate policy stages that both apply to a transaction. URL Filtering determines whether the destination may be reached at all; once traffic is allowed, DLP still inspects the payload and can block it. Allowing the application category does not exempt content from data protection rules.

Question 46Zscaler Internet Access (ZIA): policy, security and data protection

What is the purpose of Surrogate IP in ZIA?

  1. To bind a location to a GRE tunnel endpoint
  2. To translate IPv6 addresses to IPv4 for proxy connections
  3. To assign a static public address to every roaming user
  4. To associate a user identity with an IP address for a set period so devices can be identified Correct answer.

Explanation

Surrogate IP maps a source IP address to an authenticated user for a configurable timeout. Traffic from that address is then attributed to the user without requiring re-authentication on every request. It is useful for networks where many devices share an egress address.

Question 47Zscaler Internet Access (ZIA): policy, security and data protection

A URL Filtering rule is scheduled for 09:00 to 17:00, Monday through Friday. How is the rule treated at 20:00 on a Tuesday?

  1. The rule matches but only logs the request
  2. The policy falls back to the default rule for all traffic
  3. The rule does not match, and evaluation continues with the next rule Correct answer.
  4. The rule matches and blocks the request

Explanation

A time-based rule is active only inside its configured schedule window. Outside that window the rule is skipped as if it did not match, so the next rule in the policy is evaluated. Other rules therefore remain in force outside business hours.

Question 48Zscaler Internet Access (ZIA): policy, security and data protection

An internal application uses certificate pinning and fails when ZIA inspects its HTTPS traffic. Which change resolves the problem with the least disruption?

  1. Disable SSL inspection for the whole tenant
  2. Add a Do Not Inspect rule above the Inspect rule Correct answer.
  3. Import the application certificate into ZIA
  4. Move the application to an uninspected location

Explanation

A Do Not Inspect rule exempts matching traffic from decryption so the original certificate reaches the client. Because SSL inspection rules are first-match, the exception must be placed above the broader Inspect rule. This avoids weakening inspection for all other traffic.

Question 49Zscaler Internet Access (ZIA): policy, security and data protection

In a Cloud App Control rule, what does the Caution action do?

  1. It limits the user to read-only access within the app
  2. It renders the application in an isolated remote browser
  3. It blocks the application and logs the attempt
  4. It shows a warning page and lets the user proceed Correct answer.

Explanation

Caution presents an interstitial warning that explains the risk of the application and allows the user to continue. It is used to discourage rather than forbid use. Blocking and isolation are separate actions with different behavior.

Question 50Zscaler Internet Access (ZIA): policy, security and data protection

What does ZIA Advanced Threat Protection inspect?

  1. DNS queries for command-and-control domains exclusively
  2. All network traffic on every port at layer 3
  3. Web content inline, blocking known malicious sites and malicious signatures Correct answer.
  4. Only files that administrators have submitted manually

Explanation

Advanced Threat Protection inspects web content inline as it passes through the service, blocking traffic associated with known malicious sites, phishing pages, and malicious signatures. It works without waiting for files to be detonated. It complements Sandbox, which handles unknown files.