Zscaler ZDTA: Zscaler Digital Transformation Administrator (ZDTA)

Last checked November 10, 2026 against the official Zscaler exam page.

1. Question 1Policy & Security Configuration

   A banking application uses certificate pinning. After SSL inspection is enabled for all users, the app fails to load for everyone. Which change is the most appropriate fix?

   1. ATurn off every web security policy for all users until the bank's support team responds
   2. BAdd all banking users to the super administrator role so the app can be reached through inspection
   3. CInstall a new root certificate on the bank's servers so the inspection certificate is trusted
   4. DAdd the banking app's destination to the SSL bypass list so its traffic is not decrypted
   Show answer and explanationHide answer

   Correct answer: D

   Pinned applications reject the substituted certificate used during inspection, so bypassing decryption for that destination is the targeted fix. Disabling every policy is far broader than needed, and changing the bank's servers or granting admin rights does not address the pinning.

2. Question 2User & Device Management

   A company's identity provider sends a department attribute with every SAML sign-in. The security team wants Zscaler policies to apply to all Finance staff without maintaining per-user assignments. What is the most appropriate approach?

   1. AAssign each Finance employee individually to every policy rule they need to use
   2. BCreate a separate Zscaler tenant for the Finance team and move its users into it
   3. CMap the department attribute from the identity provider to a group and reference that group in policies
   4. DRemove the department attribute from the SAML response and rely on email domains instead
   Show answer and explanationHide answer

   Correct answer: C

   Mapping identity provider attributes to groups lets policies target a whole population that updates automatically as the directory changes. Per-user assignment does not scale, a separate tenant splits administration without need, and removing the attribute discards the data that policy matching depends on.

3. Question 3Platform Management

   A sales engineer's laptop leaves the corporate network and connects from a hotel. The team wants the same web policies applied to this laptop as when it is in the office. What should the administrator confirm?

   1. AThe hotel's Wi-Fi network is added as a location with a static public IP address
   2. BThe laptop is placed in a firewall rule that allows every destination without logging
   3. CThe Client Connector is installed and forwards the laptop's traffic to the Zscaler cloud
   4. DThe laptop's DNS server is changed to an internal resolver reachable only from the office
   Show answer and explanationHide answer

   Correct answer: C

   Off-network users need the Client Connector so their traffic still reaches the cloud policy engine from any network. A hotel network has no fixed public address to register as a location, and the other options either bypass policy or depend on resolvers that a roaming laptop cannot reach.

4. Question 4Monitoring, Reporting & Analytics

   A security analyst must determine which websites an employee visited over the past week. Which log type should the analyst review first?

   1. AWeb logs, which record URL-level transactions for the employee's internet access
   2. BFirewall logs, which show the protocol, port and session details for each connection
   3. CAdministrator audit logs, which record the configuration changes made to the tenant
   4. DExecutive summary reports, which show aggregated totals without individual requests
   Show answer and explanationHide answer

   Correct answer: A

   Web logs record URL-level transaction details for internet browsing, which is the data needed to see which sites were visited. Firewall logs show network-level session details, audit logs track administrative changes, and summary reports aggregate data so individual visits are not visible.

5. Question 5Troubleshooting & Incident Response

   Several users report that a SaaS application feels slow. The team needs to determine whether the delay is on the user's device, the local network, the Zscaler path or the application itself. Which tool best supports this?

   1. AThe executive summary dashboard, which shows monthly totals of blocked and allowed requests across the whole tenant
   2. BThe firewall log export, which lists only the connections that the firewall blocked
   3. CZDX, which provides per-user experience metrics across each segment of the connection path
   4. DA DLP dictionary test, which measures how quickly uploaded files are scanned for patterns
   Show answer and explanationHide answer

   Correct answer: C

   ZDX (Zscaler Digital Experience) measures application and network performance from the user's perspective, which helps isolate where the slowdown occurs. The firewall export, the summary dashboard and a DLP dictionary test do not measure end-to-end experience across the path.