ZDTA Practice Questions

A.  

Apply service-to-service policies tied to server identity so that the payroll application can reach the database on the required port, and deny other application servers from initiating flows to the database

B.  

Consolidate both applications into one broad segment and add IPS signatures to suppress suspicious traffic between servers

C.  

Configure a trusted-network condition that prioritizes corporate subnets so contractor sessions default to restricted routing policies

D.  

Increase the global user risk-score threshold before allowing access to the wiki segment to gate contractor sessions

A.  

Zscaler Client Connector will encapsulate the user ' s traffic in GRE tunnels to the ZT

E.  

B.  

Zscaler Client Connector will encapsulate the user ' s traffic in IPSec tunnels to the ZT

E.  

C.  

Zscaler Client Connector will encapsulate the user ' s traffic in DTLS/TLS tunnels to the ZT

E.  

D.  

Zscaler Client Connector will encapsulate the user ' s traffic in HTTP Connect tunnels to the ZT

E.  

A.  

Single DNS resolver with forwarders providing centralized results

B.  

Private MPLS in each branch office providing connection

C.  

Multiple distributed DNS resolvers providing local results

D.  

Optimized TCP Scaling for maximum throughput of files

A.  

A successful sign-in by a read-only auditor from a branch office and a subsequent group-membership cleanup with a comment

B.  

Multiple lockout events for a non-administrator account and a later unremarkable sign-in from a corporate VPN

C.  

Two expired-token errors for an API client and a later password change logged with a documented request ID

D.  

A successful administrative sign-in from an untrusted IP address promptly followed by role elevation on the same account session

A.  

Basic and OAuth

B.  

Token and OAuth

C.  

Basic and Token

D.  

Digest and OAuth

A.  

Allow Cascading

B.  

Allow and Quarantine

C.  

Allow URL Filtering

D.  

Allow and Scan

A.  

Engage the DLP policy owners to refine the rule context, scope the exception to the approved application and engineering group, and retain enforcement everywhere else

B.  

Ask SIEM analysts to suppress correlated alerts for source-code uploads to reduce operational noise

C.  

Direct the firewall team to relax deep packet inspection on developer ports to prevent inspection-related disruptions

D.  

Ask the identity team to remap group attributes so engineers inherit a less restrictive baseline and bypass the data-protection rule

A.  

URL Filtering precedence suppressed the access policy to prevent duplicate enforcement

B.  

Posture profiles enforced an AND condition that masked identity checks at session start

C.  

The policy relied on SAML group attributes that had not refreshed, so the session was evaluated against stale membership

D.  

The deny rule matched but was downgraded because of location-group prioritization

A.  

--deviceToken and --strictEnforcement

B.  

This is automatic when SAML is configured. No options are required.

C.  

--cloudName and --userDomain

D.  

--policyToken and --userDomain

A.  

After passing criteria checks related to authorization and security.

B.  

Immediately upon connection request for best performance.

C.  

After a short delay of a random number of seconds.

D.  

After verifying the user password inside of private application.