ZDTA study plan
ZDTA · Give each week a clear focus.
8 weeks · About 7 hours per week
Zscaler Internet Access (ZIA): policy, security and data protection
Diagram ZIA policy evaluation order across URL filtering, Cloud App Control, SSL inspection, and data protection rules.
Configure a lab rule set for three user groups using URL filtering, file-type control, and SaaS tenancy restrictions.
Compare inline proxy, PAC file, and tunnel forwarding modes for their effect on ZIA policy enforcement.
Write 10 allow/block test cases with expected outcomes and identify rule-order conflicts.
Your checkpoint
A 12-scenario ZIA policy matrix listing rule order, expected action, conflict notes, and lab test results.
Zscaler Internet Access (ZIA): policy, security and data protection & Zscaler Private Access (ZPA): application access and segmentation
Configure ZPA application segments, segment groups, and access policies for three internal applications.
Map ZIA data protection controls to two data-in-motion use cases involving DLP and Cloud App Control.
Test ZPA user-to-application access using least-privilege policy and document each failure.
Compare ZIA and ZPA policy enforcement points for internet traffic versus private application traffic.
Your checkpoint
A working lab with three ZPA application segments and matching ZIA data protection rules, plus a 15-case test log with pass/fail results.
Zscaler Private Access (ZPA): application access and segmentation & Zero Trust Architecture and the Zscaler Zero Trust Exchange
Design an application segmentation model using ZPA application segments, server groups, and Connector groups for a three-tier application.
Explain how the Zero Trust Exchange shares identity, device, and policy context across ZIA, ZPA, and ZDX.
Configure identity-provider-based access policies using SAML attributes in the lab.
Troubleshoot two ZPA Connector or application-segment failures using logs and status pages.
Your checkpoint
A segmentation design document for a three-tier application with Connector placement, access-policy matrix, and two resolved troubleshooting cases.
Zero Trust Architecture and the Zscaler Zero Trust Exchange
Compare ZTNA, VPN, and traditional perimeter models across five criteria: identity, device trust, least privilege, visibility, and scalability.
Map the Zero Trust pillars of identity, device, network, application/workload, and data to specific Zscaler controls.
Design a phased VPN-to-ZPA migration for 200 users with success metrics and rollback triggers.
Identify which logs and telemetry sources support Zero Trust policy decisions and investigations.
Your checkpoint
A migration runbook containing phases, success metrics, rollback triggers, and a control-mapping table.
Zscaler Digital Experience (ZDX): monitoring and troubleshooting & Zscaler Client Connector and traffic forwarding
Deploy Zscaler Client Connector in the lab and configure a forwarding profile for ZIA and ZPA traffic.
Interpret ZDX score, hop, and application metrics for three synthetic incident scenarios.
Trace a user-experience issue from device to application using ZDX data and Client Connector logs.
Compare tunnel, PAC, and proxy forwarding options for four user scenarios.
Your checkpoint
A three-case incident triage report mapping symptoms to ZDX metrics, forwarding configuration, and resolution steps.
Zscaler Client Connector and traffic forwarding & Administration, reporting and operational best practices
Configure Client Connector deployment through MDM enrollment for two operating-system types in the lab.
Build a forwarding-profile decision tree for road-warrior, branch, and VDI users.
Configure role-based administration with least privilege for four administrator personas.
Run a configuration audit and document drift between intended and deployed settings.
Your checkpoint
A forwarding decision tree plus an RBAC matrix for four personas and 10 completed audit checks.
Zscaler Digital Experience (ZDX): monitoring and troubleshooting & Administration, reporting and operational best practices
Build a ZDX monitoring plan with alert thresholds for five critical applications.
Analyze weekly reporting for policy hits, DLP incidents, and ZDX failure trends.
Create an operational runbook covering escalation, change control, and rollback.
Practice explaining a ZDX or ZIA dashboard to a nontechnical stakeholder.
Your checkpoint
A monitoring and reporting pack containing five alert definitions, one weekly report template, and an escalation runbook.
Zscaler Internet Access (ZIA): policy, security and data protection & Zscaler Private Access (ZPA): application access and segmentation
Complete two timed 60-question mixed practice exams covering all domains and review every missed item.
Rebuild the top 10 most-missed policy scenarios from memory in the lab.
Explain the end-to-end ZIA and ZPA integration and troubleshooting flow without notes.
Finalize a one-page original exam-day reference sheet focused on weak areas.
Your checkpoint
A second-attempt practice exam score of at least 85% and a one-page reference sheet with 10 weak areas documented as resolved.
Milestones
Week 2: Pass a 15-case ZIA/ZPA lab test log with at least 13 correct expected outcomes and no unexplained rule-order conflicts.
Week 4: Score at least 80% on a 30-question mixed Domains 1-3 self-assessment and deliver a 20-minute lab walkthrough of ZIA and ZPA policy enforcement.
Week 6: Demonstrate Client Connector enrollment on two OS types, apply the RBAC matrix to four test personas, and complete all 10 audit checks without critical drift findings.
Week 8: Score at least 85% on the second 60-question mixed practice exam and submit the one-page reference sheet with all 10 weak areas marked resolved.