ZDTA Practice Questions

A.  

The time-of-day block inherits timing from device posture, which desynchronizes evaluation and produces inconsistent enforcement

B.  

The initial allow rule matches first and stops further evaluation, so the time-of-day block never applies and access remains available after business hours

C.  

The logging rule takes precedence because of its action type, preventing the block from being reached

D.  

The sanctioned application category becomes invalid during SSL inspection, sending the request to a default allow path that bypasses time restrictions

A.  

When a condition is met, an Access Policy can either allow or block access to Application Segments OR Application Segment Groups.

B.  

When a condition is met, an Access Policy can allow access to Application Segments Groups and block access to Application Segment.

C.  

When a condition is met. an Access Policy can either allow or block access to Application Segments and Application Segment Groups.

D.  

When a condition is met, an Access Policy can allow access to Application Segments and block access to Application Segment Groups.

A.  

RDP, VNC and SSH

B.  

RDP, SSH and DHCP

C.  

SSH, DNS and DHCP

D.  

RDP, DNS and VNC

A.  

Remote access trojans

B.  

Phishing

C.  

Exploit kits

D.  

Watering hole attack

A.  

Reorder policies in the Zscaler Policy Framework so decryption exceptions evaluate before Cloud App Control decisions, and apply Bandwidth Control after access decisions.

B.  

Increase threat protection engine sensitivity and rely on default precedence to resolve conflicts between decryption, app controls, and QoS rules.

C.  

Place Bandwidth Control policies at the top of the stack and expect decryption exceptions and SaaS restrictions to evaluate subsequently.

D.  

Enable global SSL inspection and create a group and category-based bypass policy above the global inspection rule.

A.  

Review Data Discovery reports to visualize sensitive-data movement trends across channels

B.  

Check Administrator Audit Logs to evaluate configuration changes that might affect outcomes

C.  

Use Web Insights to compare browsing categories and threat actions across users and URLs

D.  

Open Firewall Insights to analyze rule-hit metrics, network-application usage, and bandwidth by location

A.  

Finance requests are inconsistently allowed as the engine re-evaluates category parents during peak hours.

B.  

Finance requests are blocked because the global rule is matched first and halts further evaluation.

C.  

Finance requests receive partial access as the engine blends actions across both rules to minimize exposure.

D.  

Finance requests defer to departmental scope and bypass the global rule if group context is present at session start.

A.  

Client Type

B.  

SCIM User Attributes

C.  

Trusted Network

D.  

Posture Profiles

A.  

Enforcement node

B.  

Zscaler SAML SP

C.  

Mobile Admin Portal

D.  

Zero Trust Exchange

A.  

Perform daily manual updates to a URL blocklist and a separate firewall address group for each new indicator, deferring changes during peak hours

B.  

Switch IPS to detect-only mode to gather more evidence and postpone blocking until campaign indicators stabilize across multiple users

C.  

Increase Advanced Threat Protection risk sensitivity and rely on page-risk analysis to identify newly observed destinations

D.  

Use a SOAR workflow with Zscaler APIs to add domains to a custom URL category and IP addresses to a firewall destination group, with block policies applied automatically