ZDTA Practice Questions

A.  

DLP event dashboards, because data-movement visualizations can uncover configuration edits through exposure trend shifts

B.  

Firewall Insights, because network-layer telemetry can expose configuration changes through connection-state deviations

C.  

Web Insights, because application traffic views can infer administrative behavior through session lineage and path analysis

D.  

ZIdentity or Administrator Management audit logs, because they record administrator actions with the actor, timestamp, target, and outcome for direct attribution

A.  

Restore parent category membership and add a narrowly scoped user-level rule above the global NRD block to allow or isolate the pilot domains.

B.  

Move the global NRD block to the top and reference the custom category in a lower rule for limited visibility rather than enforcement.

C.  

Expand the custom category to include all observed NRDs to reduce discrepancies between global and user-level rules.

D.  

Lower the global NRD control to Caution to reduce denials during categorization volatility in the broader environment.

A.  

Isolate security operations from IT to control messaging around updates, accepting coordination gaps during rollout

B.  

Limit telemetry integration to reduce operational overhead, accepting reduced evidence for trend analysis and planning

C.  

Establish regular risk-review cycles using Risk360 dashboards and MTTR metrics, tying ticket routing and wave scheduling to observed trends and remediation progress

D.  

Trigger update waves on an ad hoc basis in response to incidents, accepting inconsistent visibility and reactive coordination

A.  

Watering Hole Attack

B.  

Pre-existing Compromise

C.  

Phishing Attack

D.  

Exploit Kits

A.  

Build ZPA Access Policy rules around a SCIM-synchronized contractor group, apply device-posture conditions to sensitive application segments, and retain a final catch-all deny rule

B.  

Prioritize ZIA URL Filtering rules that use department attributes to shape contractor access, and leave ZPA unchanged

C.  

Use location groups to provide contractors with tiered access to most internal services and defer device evaluation to downstream controls

D.  

Require session MFA for contractor authentication and use SAML attributes to relax private-application access broadly

A.  

A DLP Engine runs over the traffic being sent out and dynamically selects DLP dictionaries to apply

B.  

A Data Loss Prevention policy applies a DLP dictionaries

C.  

A Data Loss Prevention policy applies a DLP Engine and a DLP engine uses DLP dictionaries

D.  

A Data Loss Prevention policy applies a DLP Engine

A.  

Policy updates happen in real time, so the new logout password is in effect as soon as the change is saved.

B.  

The new logout password will be in effect after the Activate button is clicked in the Admin portal.

C.  

The new logout password will be in effect after the user clicks Update Policy on the client.

D.  

Policy updates occur every 60 minutes, so the logout password will be in effect after the next scheduled update.

A.  

By storing sensitive structured data on servers managed by trusted Zscaler staff for enhanced security.

B.  

By using an on-premises VM to index data and only sending hashed values to the cloud.

C.  

By requiring customers to manually hash the data and upload it to the cloud.

D.  

By encrypting sensitive data directly before storing it in the cloud.

A.  

Connect, Get, Head

B.  

Options, Delete, Put

C.  

Get, Delete, Trace

D.  

Connect, Post, Put

A.  

DLP Policies

B.  

DLP Rules

C.  

DLP dictionaries

D.  

DLP identifiers