Free Zscaler ZDTA Practice Exam with Questions & Answers | Set: 2

You need at least two App Connectors per data center to ensure high availability and load distribution, so with four data centers the minimum total is eight.

When you create a Server Group in the ZPA admin console (or via API/Infrastructure-as‑Code), you explicitly select which App Connector Groups should serve that Server Group. Those connector groups are then used to advertise reachability and steer traffic to the included application servers.

Browser Isolation enables secure access to potentially malicious or untrusted websites by rendering web pages in a remote containerized environment. This isolates any harmful content away from the user’s device, ensuring safe browsing without compromising endpoint security. This approach is especially effective for unknown or risky URLs where traditional content filtering might be insufficient.

Yes, the Access Control suite includes controls for segmentation and conditional access, which are designed to prevent lateral movement within networks. These features allow organizations to restrict access between different segments and enforce policies that limit the spread of threats or unauthorized access within internal environments.

Zscaler Platform Services, such as web filtering, advanced threat protection, DLP, and more, operate on decrypted traffic. This decryption is enabled by TLS Inspection, which intercepts SSL/TLS sessions, decrypts the payloads for inspection, and then re‑encrypts the traffic before forwarding to the destination.

When a ZDX custom application is configured with the type set to 'Network', the administrator will not get Disk I/O metrics for users. Disk I/O metrics relate to local client device performance and are not part of network-type application probes which focus on network latency, server response, and other network-centric measurements.

The study guide notes that Disk I/O is part of endpoint-level monitoring and is not collected by network-type probes, unlike metrics such as Server Response Time or ZDX Score which are network related.

The user risk score enables organizations to configure stronger user-specific policies to monitor and control user-level risk exposure. This score reflects a user's risk posture based on behaviors and detected anomalies and helps in tailoring security policies to address individual risk levels.

While the score gives insight into user risk, it is primarily designed for adaptive policy enforcement rather than direct compromise detection or cross-company comparison. The study guide highlights that user risk scores drive policy adjustments to better secure user activity.

By reviewing the user’s ZDX score for AWS and running “Analyze Score,” the Y‑Engine automatically correlates metrics (network, client, and application) to pinpoint the root cause, delivering targeted insights far faster than manual tracing or external outage checks.

Virus scanning in the Zscaler platform is part of its Malware Protection capability, which inspects file content against known virus signatures and behaviors.

When you configure a URL Filtering rule with the Caution action, the only HTTP methods you can select for that rule are CONNECT, GET, and HEAD.