Zscaler ZDTA Exam : Zscaler Digital Transformation Administrator

Which of the following refers to employees' use of unauthorized applications and services?

• A. Posture Control
• B. Data Discovery
• C. Browser Isolation
• D. Shadow IT

Logs indicate traffic to an internal hostname was permitted and not inspected, despite a posture-based access policy that should have blocked the session.
Which statement best explains this outcome?

• A. A Client Forwarding Policy bypass matched first, preventing the access policy from evaluating the session.
• B. SAML attribute mapping suppressed posture checks during reauthentication.
• C. Inspection policy overrode access controls because of protocol heuristics.
• D. Connector selection failed closed and defaulted to passthrough to reduce latency.

A company requires stricter control of non-web traffic when users are outside the corporate network.
Which adjustment best reduces unintended exposure for off-network users?

• A. Configure Zscaler Client Connector to use Z-Tunnel 1.0 when off-network, and enable the appropriate Cloud Firewall rules
• B. Duplicate the off-network block rule and place both copies below the global allow rule to provide redundant coverage and increased monitoring
• C. Increase inspection depth for on-network users to compensate for off-network access risks, assuming that stricter internal analysis provides an aggregate deterrent
• D. Configure Zscaler Client Connector to use Z-Tunnel 2.0 when off-network, and enable the appropriate Cloud Firewall rules

Architecture reviews reveal trusted network bypass is configured for headquarters, while roaming users route through the service edge. The goal is stricter controls for accessing SaaS application when off-network traffic.
What policy ensures the best coverage for this scenario?

• A. CASB app governance policies that rely on user risk scores to restrict cloud activities across all locations
• B. Data center firewall tiers that mirror internal VLANs and apply deny rules for roaming identities
• C. ZPA App Segment policies that constrain ports for legacy private applications accessed by remote users
• D. Leverage conditional access policies to ensure client sessions only come from known location or via the Zero Trust Exchange

An administrator must apply file-type controls to a subset of users while ensuring evasion-resistant detection.
Which configuration most directly maps a file-type policy to a user group and role-based security requirements?

• A. Enable MIME-type validation in a baseline content policy and expect extension mismatches to be handled through application restrictions
• B. Create a File Type Control rule using magic-byte, MIME-type, and file-extension checks; scope it to the target SCIM group and device posture; and place it above broader catch-all rules
• C. Create a URL Filtering rule scoped to the department and reference a custom URL category that lists file extensions for the restricted formats
• D. Define a global File Type Control rule that blocks risky formats and rely on identity-based reporting to address group-level differences later