Free ZDTA practice test: 30 questions with answers

Pinned applications reject the substituted certificate used during inspection, so bypassing decryption for that destination is the targeted fix. Disabling every policy is far broader than needed, and changing the bank's servers or granting admin rights does not address the pinning.

A custom URL category lets an administrator group specific sites and apply a filtering rule to that group alone. Changing a predefined category would alter classification for unrelated sites, while disabling filtering or using a DLP dictionary does not block the portals.

Sandbox analysis runs unknown files in an isolated environment and returns a verdict before delivery, and file type control determines which files are sent for that analysis. An SSL bypass or an uninspected firewall rule would skip inspection, and a logging-only URL category takes no protective action.

An application segment scoped to the HR portal, paired with an access policy for the contractor's group, gives least-privilege access to that one application. Broad subnet access and a full network VPN both exceed the requirement, and an administrator role grants management rights the contractor does not need.

Application segments name the private applications or resources that ZPA access policies control, which is the basis of least-privilege access. The other definitions describe firewall subnets, identity groups or log storage rather than the segments ZPA uses.

Mapping identity provider attributes to groups lets policies target a whole population that updates automatically as the directory changes. Per-user assignment does not scale, a separate tenant splits administration without need, and removing the attribute discards the data that policy matching depends on.

Audit logs capture administrative actions such as policy edits and role assignments so teams can trace who changed what and when. They do not enforce change windows, store end-user web traffic (that is the web log), or synchronize group membership.

A BYOD device can be onboarded through Client Connector self-enrollment while access policy restricts it to the applications it needs. A branch router tunnel cannot cover a laptop on a home network, and imaging or shared laptops do not match the BYOD model in the scenario.

Device posture profiles check attributes such as disk encryption and antivirus status and feed the result into access policy. URL categories, rule ordering and tunnel bypass do not inspect device state, so none of them can confirm that a laptop is compliant.

Group membership and department or role attributes come from the identity provider and can be mapped to groups that policies target. Firewall hit counts and sandbox verdicts are produced by Zscaler security services rather than supplied by the identity provider.

Off-network users need the Client Connector so their traffic still reaches the cloud policy engine from any network. A hotel network has no fixed public address to register as a location, and the other options either bypass policy or depend on resolvers that a roaming laptop cannot reach.

GRE encapsulates traffic but does not encrypt it, whereas IPsec provides encryption and integrity for the data it carries. The other statements reverse the encryption behaviour or attribute capabilities that neither tunnel type has on its own.

Application-level access policy lets the acquired users reach named applications without merging networks or giving them broad rights. Bridging the networks, granting domain administrator rights and disabling enforcement each expand risk well beyond what the requirement needs.

Firewall rules are read from the top down and the first match decides the outcome, so the broad allow in Rule 1 catches these users before Rule 2 is reached. The other options describe an evaluation order or rule type that does not match how the firewall processes its list.

App Connectors establish outbound connections to the ZPA cloud, which avoids opening inbound listeners on the data center firewall. Installing connectors on laptops and limiting them to public cloud applications are both incorrect, because connectors run in the data center next to the applications they serve.

Web logs record URL-level transaction details for internet browsing, which is the data needed to see which sites were visited. Firewall logs show network-level session details, audit logs track administrative changes, and summary reports aggregate data so individual visits are not visible.

An unexpected increase in privilege is a potential escalation, so the change should be traced to the account that made it and checked against approved change records. Ignoring the entry, deleting the record or resetting credentials before any investigation each damages the evidence or the response.

Executive summaries show aggregated trends, so a rise in blocked threats is a signal to investigate the sources and to confirm current policies still fit. Summaries do not name individuals, and more blocks usually means the controls are working rather than that the service has failed or dropped all traffic.

Usage reports reveal which cloud applications are in use, which supports shadow IT discovery and policy decisions about allowing or restricting them. Encrypting sessions and patching installed software are not functions of usage tracking.

Web logs record each web transaction along with the action taken and the rule that matched, which answers the question directly. The audit log tracks administrative activity, the summary shows aggregate totals, and a sandbox report covers files analyzed rather than this transaction's rule match.

ZDX (Zscaler Digital Experience) measures application and network performance from the user's perspective, which helps isolate where the slowdown occurs. The firewall export, the summary dashboard and a DLP dictionary test do not measure end-to-end experience across the path.

An SSL bypass only prevents decryption, so URL filtering decisions still apply to the requested hostname. The other options describe category changes or overrides that the bypass does not perform.

Blocking known malicious domains and IP addresses in the security policy stops access quickly for all users. A user group does not identify destinations, waiting delays protection, and disabling inspection removes visibility without blocking anything.

Restricting access contains the account, and reviewing its logs shows what it touched, while evidence is preserved. Deleting logs destroys evidence, and disabling company-wide filtering weakens protection for every user.

URL filtering rules are evaluated in order, so a broad allow placed above a block matches first for the same users and traffic. The other options describe category changes, rule deletions or inspection failures that the scenario does not indicate.

Adding App Connectors to the same connector group provides redundancy, so a restart of one connector does not interrupt access. URL categories, posture checks and SSL bypass do not address the single point of failure in the connector path.

A staged rollout limits the impact of a problem and gives the team evidence before wider deployment. Updating everything at once without testing, piloting only on executives who cannot tolerate disruption, or skipping patches each increase risk instead of reducing it.

When some clients resolve a private hostname to a public address, the application is not reached through its intended path, so DNS resolution is the first thing to verify. Changing URL categories, adding connectors or using SSL bypass do not change how the hostname resolves.

Clear communication about timing, expected changes and support channels reduces help-desk load and helps users recognize update problems early. Blocking all access, forcing uninstalls and synchronizing an unnecessary global start time each add disruption without a clear benefit.

Application segments define the ports that access is granted for, so a moved service needs its segment updated to the new port. Reinstalling the client, changing URL categories or bypassing SSL do not tell the segment which port the application now uses.