Zscaler ZS-DTA Online Practice Questions and Exam Preparation

Zscaler ZS-DTA Online Questions & Answers

• Question 41:

  An administrator needs to SSL inspect all traffic but one specific URL category. The administrator decides to create two policies, one to inspect all traffic and another one to bypass the specific category.

  What is the logical sequence in which they have to appear in the list?

  A. Both policies are incompatible, so it is not possible to have them together.
  B. First the policy for the exception Category, then further down the list the policy for the generic "inspect all."
  C. First the policy for the generic "inspect all", then further down the list the policy for the exception Category.
  D. All policies both generic and specific will be evaluated so no specific order is required.
  B. First the policy for the exception Category, then further down the list the policy for the generic "inspect all."

  ---

  Explanation

  When creating SSL inspection policies, the exception policy for the specific URL category must appear first in the policy list, followed by the more generic "inspect all" policy further down. Zscaler evaluates policies in order, so placing the exception first ensures that traffic matching that category bypasses inspection before the generic policy is applied.

  The study guide emphasizes the importance of policy order to ensure correct application of exceptions and general rules.

• Question 42:

  A user has opened a support case to complain about poor user experience when trying to manage their AWS resources.

  How could a helpdesk administrator get a useful root cause analysis to help isolate the issue in the least amount of time?

  A. Check the Zscaler Trust page for any indications of cloud outages or incidents that would be causing a slowdown.
  B. Check the user's ZDX score for a period of low score for AWS and use Analyze Score to get the ZDX Y- Engine analysis.
  C. Do a Deep Trace on the user's traffic and check for excessive DNS resolution times and other slowdowns.
  D. Initiate a packet capture from Zscaler Client Connector and escalate the case to have the trace analyzed for root cause.
  D. Initiate a packet capture from Zscaler Client Connector and escalate the case to have the trace analyzed for root cause.

  ---

  Explanation

  By reviewing the user's ZDX score for AWS and running "Analyze Score," the Y#Engine automatically correlates metrics (network, client, and application) to pinpoint the root cause, delivering targeted insights far faster than manual tracing or external outage checks.

• Question 43:

  Which filtering policy blocked access to the Network Application?

  A. Sandbox
  B. Browser Control
  C. Firewall Filtering
  D. DLP
  C. Firewall Filtering

  ---

  Explanation

  Firewall Filtering policies govern network#level application traffic, so access to a Network Application is blocked by a Firewall Filtering rule.

• Question 44:

  What does the user risk score enable a user to do?

  A. Compare the user risk score with other companies to evaluate users vs other companies.
  B. Determine whether or not a user is authorized to view unencrypted data.
  C. Configure stronger user-specific policies to monitor & control user-level risk exposure.
  D. Determine if a user has been compromised
  C. Configure stronger user-specific policies to monitor & control user-level risk exposure.

  ---

  Explanation

  The user risk score enables organizations to configure stronger user-specific policies to monitor and control user-level risk exposure. This score reflects a user's risk posture based on behaviors and detected anomalies and helps in tailoring security policies to address individual risk levels. While the score gives insight into user risk, it is primarily designed for adaptive policy enforcement rather than direct compromise detection or cross-company comparison. The study guide highlights that user risk scores drive policy adjustments to better secure user activity.

• Question 45:

  How does a Zscaler administrator troubleshoot a certificate pinned application?

  A. They could look at SSL logs for a failed client handshake.
  B. They could reboot the endpoint device.
  C. They could inspect the ZIA Web Policy.
  D. They could look into the SaaS application analytics tab.
  A. They could look at SSL logs for a failed client handshake.

  ---

  Explanation

  Certificate pinning prevents SSL interception by validating a server's certificate against known values. When ZIA performs SSL inspection, it substitutes the certificate with one signed by Zscaler's CA. This causes the handshake to fail for pinned applications. To troubleshoot, an administrator should review SSL logs to identify handshake failures, which indicate certificate pinning issues. Logs will show the TLS negotiation details, including any disruptions.

  References:

  Zscaler Digital Transformation Study Guide - SSL Inspection and Threat Protection > Troubleshooting Certificate Pinned Applications

• Question 46:

  Which of the following statements accurately reflects Zscaler's file size limitation for Malware Protection scans?

  A. Zscaler scans all files regardless of size.
  B. Zscaler scans files only if they are below 100 MB.
  C. Zscaler scans files up to 500 MB
  D. Zscaler scans files up to 400 MB.
  B. Zscaler scans files only if they are below 100 MB.

  ---

  Explanation

  Zscaler's Malware Protection engine performs inline scanning on files up to 100 MB in size; files larger than this limit bypass inline malware inspection.

• Question 47:

  The Zscaler Gen AI Security Report gives visibility and insight into an organization's use of generative AI applications.

  What kind of log will include Prompt for administrators to view for different prompts entered by users in those applications?

  A. SaaS Security Logs
  B. Web Insights Logs
  C. Gen AI Insights Logs
  D. Advanced Firewall Logs
  B. Web Insights Logs

  ---

  Explanation

  When administrators view the Generative AI Security Report and click to see "Prompts," they're taken into the Web Insights Logs page, where each user's input prompts to AI applications are recorded and displayed.

  References:

  https://help.zscaler.com/zia/about-generative-ai-security-report

• Question 48:

  Security analysts need to review logs but must not change policies.

  How should their access be configured?

  A. Assign a policy administrator role and ask them not to edit
  B. Give them a shared unrestricted account
  C. Assign a read-only role for the required logging scope
  D. Add them to every synchronized administrative group
  C. Assign a read-only role for the required logging scope

  ---

  Explanation

  A read-only logging role supports the analysts' function while preventing configuration changes. Procedural warnings do not provide the same enforcement as scoped authorization.

• Question 49:

  Zscaler Platform Services works upon unencrypted data from encrypted communications due to which of the following?

  A. Antivirus
  B. Tenant Restrictions
  C. Web Filtering
  D. TLS Inspection
  D. TLS Inspection

  ---

  Explanation

  Zscaler Platform Services, such as web filtering, advanced threat protection, DLP, and more, operate on decrypted traffic. This decryption is enabled by TLS Inspection, which intercepts SSL/TLS sessions, decrypts the payloads for inspection, and then re#encrypts the traffic before forwarding to the destination.

• Question 50:

  Which of the following options will protect against Botnet activity using IPS and Yara type content analysis?

  A. Command and Control Traffic
  B. Ransomware
  C. Troians
  D. Adware/Spyware Protection
  A. Command and Control Traffic

  ---

  Explanation

  Zscaler's IPS engine and Yara#style content signatures specifically detect and block botnet command#and#control traffic, stopping infected hosts from communicating with C2 servers.