Free ZDTA sample questions

Correct answers: Cloud App Control with Tenant Restrictions to allow access only to the corporate instances of sanctioned cloud storage applications.; Data Loss Prevention (DLP) policies with custom dictionaries and file type controls to detect and block the upload of CAD files to unsanctioned destinations.

Tenant Restriction is a specific feature within Cloud App Control that allows administrators to permit access to SaaS applications like Google Drive but restrict logins to specific corporate tenants, effectively blocking personal accounts.

DLP is essential for inspecting the content of uploads. By configuring it to identify CAD file types and proprietary design patterns, it can block the exfiltration of sensitive data, even if the user is attempting to upload to a permitted site.

Correct answer: The App Connector does not have a DNS resolver configured that can resolve the microservice's FQDN.

A common ZPA deployment issue is DNS resolution. The App Connector itself must be able to resolve the FQDNs of the applications it is serving. If the App Connector is using a generic public DNS server, it will likely fail to resolve internal, private FQDNs. The App Connector's underlying OS must be configured to use an internal DNS server (like Amazon Route 53 Resolver for a VPC) that can resolve the application's address.

Correct answer: ZIA Web Insights Logs, filtered by the specific user.

ZIA's Web Insights Logs provide a detailed, real-time record of every web transaction for a specific user. After a Deception alert, an analyst can pivot directly to the Web Insights Logs, filter by the user involved, and see all their recent web activity, including URLs visited, cloud applications used, threat categories triggered, and data exfiltration attempts. This provides the richest context for understanding the scope of the compromise.

Correct answer: True

This statement is true. The SCIM bearer token is a long-lived API key that authorizes the IdP to make create, read, update, and delete (CRUD) operations on Zscaler's user and group database via the SCIM API. It must be treated as a sensitive secret and stored securely within the IdP's enterprise application configuration.

Correct answer: ZDX Deep Tracing.

ZDX Deep Tracing is the specific feature designed for this purpose. It initiates a detailed, real-time analysis of the network path from the user's device, across their local network, through the Zscaler cloud, and across the internet to the application's servers. It provides latency and packet loss metrics for each hop, allowing administrators to visually identify the exact segment of the path causing the performance degradation.

Correct answer: The ZIA REST API.

The ZIA REST API provides endpoints for programmatically managing various ZIA configurations, including URL categories. The threat intelligence platform would use a script or its built-in integration capabilities to authenticate to the ZIA API and issue POST requests to the `/urlCategories` endpoint to add the new malicious domains to the specified block list. This enables a fully automated threat response workflow.

Correct answers: An App Connector deployed in the private data center with network visibility to the EHR server.; A ZPA Application Segment configured for the EHR application with Browser Access enabled.; A ZPA Access Policy that grants the auditors' user group access to the EHR Application Segment.

The App Connector is the fundamental component that establishes an inside-out connection from the private network to the Zscaler cloud, making the internal application available without opening inbound firewall ports.

The Application Segment defines the application being accessed. Enabling the 'Browser Access' option specifically activates the clientless access feature for that application.

Access in ZPA is deny-by-default. An explicit Access Policy is required to connect a specific user group (the auditors) to a specific Application Segment (the EHR system).

Correct answer: Creating a URL Filtering policy rule to block the 'Newly Registered and Observed Domains' URL category.

Zscaler maintains a dynamic URL category specifically for 'Newly Registered and Observed Domains'. This category automatically includes domains that have been registered or become active within the last 30 days. By creating a URL Filtering policy to block this category, an organization can proactively prevent users from accessing these high-risk sites, which are frequently used for malicious activities.

Correct answer: Location: Campus Lab, Network Service: TCP_22, Action: Allow

A ZIA Firewall Control policy rule is evaluated based on multiple criteria. To meet this requirement, the rule must specify the source of the traffic ('Location: Campus Lab'), the type of traffic ('Network Service: TCP_22' which is the standard service object for SSH), and the desired outcome ('Action: Allow'). This combination ensures that only SSH traffic originating from the specified location is permitted.

Correct answer: The policy's 'Match Count' threshold is set higher than 15.

ZIA DLP policies trigger based on a 'Match Count' threshold, which specifies how many times a dictionary term or pattern must be found before the policy action is taken. The default is often higher than 1 to reduce false positives. If the tester's document contained 15 credit card numbers but the policy's match count was set to 20, the policy would not trigger. This is the most common reason for a seemingly correct policy not firing.