Zscaler ZS-DTA Online Practice Questions and Exam Preparation

Zscaler ZS-DTA Online Questions & Answers

• Question 81:

  Zscaler forwards the server SSL/TLS certificate directly to the user's browser session in which situation?

  A. When traffic contains a known threat signature.
  B. When web traffic is on custom TCP ports.
  C. When traffic is exempted in SSL Inspection policy rules.
  D. When user has connected to server in the past.
  C. When traffic is exempted in SSL Inspection policy rules.

  ---

  Explanation

  When a connection matches an SSL Inspection rule set to "bypass," Zscaler performs a passthrough, simply relaying the origin server's certificate intact to the client rather than substituting its own.

• Question 82:

  When users are authenticated using SAML, what are the two most efficient ways of provisioning the users?

  A. Hosted User Database and Directory Server Synchronization
  B. SAML and Hosted User Database
  C. SCIM and Directory Server Synchronization
  D. SCIM and SAML Autoprovisioning
  D. SCIM and SAML Autoprovisioning

  ---

  Explanation

  The two most efficient ways to provision users authenticated via SAML are SCIM (System for Cross-domain Identity Management) and SAML Autoprovisioning. SCIM allows automated user provisioning and deprovisioning, while SAML Autoprovisioning enables dynamic user account creation upon authentication, streamlining user lifecycle management.

• Question 83:

  A policy depends on a department attribute, but a newly provisioned user does not receive the expected access.

  What is the most relevant check?

  A. Increase the user's administrative role
  B. Delete unrelated traffic logs
  C. Change the organization's verified domain
  D. Verify that the identity source sends the attribute and that it maps to the expected user field
  D. Verify that the identity source sends the attribute and that it maps to the expected user field

  ---

  Explanation

  Attribute-based policy requires the expected value to be supplied and mapped correctly. Administrative privilege and unrelated domain or logging changes do not repair missing identity data.

• Question 84:

  When configuring Webhook alerts in ZIA, what are the two Webhook authentications types supported?

  A. Basic and OAuth
  B. Token and OAuth
  C. Basic and Token
  D. Digest and OAuth
  C. Basic and Token

  ---

  Explanation

  When you configure Webhook alerts in Zscaler Internet Access, the only two authentication methods you can choose are Basic (username/password) and Token (API token).

  References:

  https://help.zscaler.com/zia/adding-webhook

• Question 85:

  Which Risk360 key focus area observes a broad range of event, security configurations, and traffic flow attributes?

  A. External Attack Surface
  B. Prevent Compromise
  C. Data Loss
  D. Lateral Propagation
  B. Prevent Compromise

  ---

  Explanation

  Prevent Compromise analyzes device and network telemetry - including security configurations, event logs, and traffic flows - to gauge how well you're blocking initial intrusion attempts and misconfigurations.

• Question 86:

  An organization is moving administrators from local sign-on to an external identity provider.

  Which rollout approach provides the safest recovery path?

  A. Test with a small administrator group while retaining a controlled recovery account
  B. Delete all local administrative access before the first test
  C. Assign every user an administrative role during the transition
  D. Disable audit logging until migration is complete
  A. Test with a small administrator group while retaining a controlled recovery account

  ---

  Explanation

  A staged test limits impact, while a tightly controlled recovery account prevents a complete administrative lockout. Removing all fallback access before validation creates avoidable operational risk.

• Question 87:

  What happens after the Zscaler Client Connector receives a valid SAML response from the Identity Provider (IdP)?

  A. The Zscaler Client Connector Portal authenticates the user directly.
  B. There is no need for further actions as the SAML is valid, access is granted immediately.
  C. The SAML response is sent back to the user's device for local validation.
  D. Zscaler Internet Access validates the SAML response and returns an authentication token.
  D. Zscaler Internet Access validates the SAML response and returns an authentication token.

  ---

  Explanation

  After the Zscaler Client Connector (ZCC) receives a valid SAML response, Zscaler Internet Access (ZIA) takes over to validate the SAML assertion. Upon successful validation, ZIA issues an authentication token that allows the user to access services securely. This centralized validation ensures authentication integrity and enables seamless policy enforcement across Zscaler services.

  References:

  Zscaler Digital Transformation Study Guide - Authentication and User Management > SAML Authentication Flow

• Question 88:

  Client Connector forwarding profile determines how we want to forward the traffic to the Zscaler Cloud.

  Assuming we have configured tunnels (GRE or IPSEC) from locations, what is the recommended combination for on-trusted and off-trusted options?

  A. Tunnel v2.0 for on-trusted and tunnel v2.0 for off-trusted
  B. None for on-trusted and none for off-trusted
  C. None for on-trusted and tunnel v2.0 for off-trusted
  D. Tunnel v2.0 for on-trusted and none for off-trusted
  D. Tunnel v2.0 for on-trusted and none for off-trusted

  ---

  Explanation

  When tunnels (GRE/IPSec) are already configured from trusted locations (like branch offices), the recommended setting is "Tunnel v2.0" for on-trusted networks and "None" for off-trusted. This ensures that while on a corporate network, the Zscaler Client Connector uses the pre-established tunnels, but falls back to direct or other secure methods (like VPN or ZCC tunnel) when off-trusted. This aligns with Zscaler's best practices for hybrid deployment.

  References:

  Zscaler Digital Transformation Study Guide - Traffic Forwarding and Deployment Models > Client Connector Forwarding Profile Settings

• Question 89:

  When creating an installer package or using the command-line for installation, which Zscaler Client Connector installer options are used to automatically redirect to your corporate SAML IdP on launch?

  A. --deviceToken and --strictEnforcement
  B. This is automatic when SAML is configured. No options are required.
  C. --cloudName and --userDomain
  D. --policyToken and --userDomain
  C. --cloudName and --userDomain

  ---

  Explanation

  During installation, specifying the --cloudName and --userDomain options instructs the Client Connector to automatically redirect users to your corporate SAML IdP when the app launches.

• Question 90:

  Which are valid criteria for use in Access Policy Rules for ZPA?

  A. Group Membership, ZIA Risk Score, Domain Joined, Certificate Trust
  B. Username, Trusted Network Status, Password, Location
  C. SCIM Group, Time of Day, Client Type, Country Code
  D. Department, SNI, Branch Connector Group, Machine Group
  A. Group Membership, ZIA Risk Score, Domain Joined, Certificate Trust

  ---

  Explanation

  Valid criteria for Access Policy Rules in ZPA include Group Membership, ZIA Risk Score, Domain Joined, and Certificate Trust. These attributes allow granular policy decisions based on user identity, device posture, and risk context.

  Options including password are invalid as passwords are not used as policy criteria; similarly, SNI and Branch Connector Group are more relevant to other controls. The study guide lists these user and device attributes explicitly as policy criteria within ZPA access policies.