zscaler ZDTA Exam Questions

Questions for the ZDTA were updated on : Nov 21 ,2025

Page 1 out of 9. Viewing questions 1-15 out of 125

Question 1

Which of the following DLP Notification methods can be used to forward a copy of the data that
triggered the DLP policy to the auditor?

  • A. Email Notification Template
  • B. NSS Log Forwarding to SIEM
  • C. SMS Text Message via PagerDuty
  • D. Zscaler Client Connector pop-up message
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
The Email Notification Template is the built in mechanism for forwarding a copy of the exact content
that triggered a DLP rule to your designated auditor via email.

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 2

Which Platform Service enables visibility into the headers and payload of encrypted transactions?

  • A. Policy Framework
  • B. TLS Decryption
  • C. Reporting and Logging
  • D. Device Posture
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
The TLS Decryption platform service intercepts and decrypts SSL/TLS sessions, granting Zscaler access
to both headers and payloads of encrypted traffic for inspection and policy enforcement.

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 3

Zscaler Client Connector checks for software updates automatically at which interval?

  • A. Every 6 hours
  • B. Every 12 hours
  • C. Every 2 hours
  • D. Every 24 hours
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
Zscaler Client Connector automatically checks for software updates every 2 hours by default.

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 4

When configuring Zscaler Private Access, what is the function of the Server Group?

  • A. Maps FQDNs to IP Addresses
  • B. Maps Applications to FQDNs
  • C. Maps App Connector Groups to Application Segments
  • D. Maps Applications to Application Groups
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
A Server Group holds the actual backend endpoints - defined by FQDNs (or IPs) and ports - and
effectively maps those FQDNs to their IP addresses so ZPA knows which hosts to steer traffic toward.

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 5

In which of the following SaaS apps can you protect data at rest via Zscaler's out-of-band CASB
solution?

  • A. Yahoo Mail
  • B. Twitter.
  • C. Google Drive.
  • D. Facebook.
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
Zscaler’s out of band CASB solution supports data at rest protection for cloud storage platforms like
Google Drive, enabling scanning and governance of files stored there.

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 6

Which of the following scenarios would generate a “Patient 0” alert?

  • A. Zscaler's AI/ML based Smart Browser Isolation was triggered due to a users accessing a newly- registered domain.
  • B. A new malicious file was detected by the sandbox due to an “allow and scan” First-Time Action in the sandbox policy.
  • C. A new malicious file was detected by the sandbox due to an “quarantine” First-Time Action in the sandbox policy.
  • D. Zscaler detected a HIPAA violation with in-band Data Protection scanning.
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
A “Patient 0” alert fires when the first instance of a previously unknown file slips through (under an
“Allow and Scan” first time action) and is later classified as malicious by the sandbox, identifying that
initial download as the zero day event.

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 7

When configuring Applications to be monitored, what probe types can be created?

  • A. Page Fetch Time Probe and Cloud Path Probe
  • B. Web Probe and Page Fetch Time Probe
  • C. Page Fetch Time Probe and Server Response time Probe
  • D. Web Probe and Cloud Path Probe
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
When you set up application monitoring in ZDX, you can create Web Probes to measure application
performance from the browser and Cloud Path Probes to map and monitor the network path to
those applications.

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 8

Which of the following components is installed on an endpoint to connect users to the Zero Trust
Exchange regardless of their location - home, work, while traveling, etc.?

  • A. Client connector
  • B. Private Service Edge
  • C. IPSec/GRE Tunnel
  • D. App Connector
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
The Zscaler Client Connector is the lightweight agent installed on endpoints - whether at home, in
the office, or on the road - to securely forward user traffic into the Zero Trust Exchange.

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 9

Layered defense throughout an organization security platform is valuable because of which of the
following?

  • A. Layered defense increases costs to attackers to operate.
  • B. Layered defense from multiple vendor solutions easily share attacker data.
  • C. Layered defense ensures attackers are prevented eventually.
  • D. Layered defense with multiple endpoint agents protects from attackers.
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
By deploying multiple, overlapping security controls at different layers, you force adversaries to
overcome each barrier, significantly raising the cost, complexity, and time required for a successful
attack.

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 10

You recently deployed an additional App Connector to and existing app connector group. What do
you need to do before starting the zpa-connector service?

  • A. Copy the group provisioning key to /opt/zscaler/var/provision key
  • B. Monitor the peak CPU and memory utilization of the AC
  • C. Schedule periodic software updates for the agg connector group
  • D. Check the status of the new App Connector in the administration portal
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
Before you start the zpa-connector service on the new host, you must place the App Connector
Group’s provisioning key into /opt/zscaler/var/provision_key so it can register with the control plane.

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 11

For a deployment using both ZIA and ZPA set of services, what is the best authentication solution?

  • A. Use forms Authentication in ZPA and SAML in ZIA
  • B. Use forms Authentication in ZIA and SAML in ZPA
  • C. Configure Authentication using SAML on both ZIA and ZPA
  • D. Use forms Authentication for both ZIA and ZPA
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
For a unified, seamless experience - and because ZPA only supports SAML while ZIA’s recommended
authentication is also SAML - you should configure SAML based SSO on both ZIA and ZPA. This
ensures one consistent identity flow and eliminates multiple credential prompts across the
platforms.

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 12

Is SCIM required for ZIA?

  • A. Depends
  • B. Maybe
  • C. No
  • D. Yes
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
SCIM is optional for ZIA user provisioning - you can onboard users via manual CSV import, SAML
attributes, or other identity integrations without implementing SCIM.

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 13

The Zscaler platform can protect against malicious files, URLs and content based on a number of
criteria including reputation type. What type of checking is virus scanning?

  • A. Malware protection
  • B. File reputation
  • C. SHA-256 hashing
  • D. Site reputation
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
Virus scanning in the Zscaler platform is part of its Malware Protection capability, which inspects file
content against known virus signatures and behaviors.

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 14

Which feature does Zscaler Client Connector Z-Tunnel 2.0 enable over Z-Tunnel 1.0?

  • A. Enables SSL Inspection for Client Connector
  • B. Inspection of all ports and protocols via Cloud Firewall
  • C. Enables Browser Isolation
  • D. Enables multicast traffic
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
Z-Tunnel 2.0 upgrades over 1.0 by carrying all ports and protocols through the Cloud Firewall for
inspection - rather than being limited to just HTTP/HTTPS - ensuring full visibility and control.

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 15

What ports and protocols are forwarded to the Zero Trust Exchange when Zscaler Client Connector is
using Tunnel 2.0?

  • A. TCP ports 80, 443 and 8080 only.
  • B. Any HTTP/HTTPS traffic as well as DNS.
  • C. All TCP and UDP ports as well as ICMP traffic.
  • D. All Web ports as well as FTP and SSH.
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
Zscaler Client Connector’s Tunnel 2.0 uses a packet filter based tunnel that encapsulates all IP traffic -
both TCP and UDP on any port, plus ICMP - to the Zero Trust Exchange

Discussions
vote your answer:
A
B
C
D
0 / 1000
To page 2