Free Zscaler ZDTA Practice Exam with Questions & Answers | Set: 5

Cloud Sandbox is built for unknown and suspicious files, especially when static signatures are not enough. The file is detonated in an isolated environment so Zscaler can observe behavior and assign a verdict before allowing it to reach users. Option C (Identify Zero-Day Threats) is correct because sandboxing is most valuable for identifying zero-day threats and advanced malware behavior.

Why the other options are incorrect:

A. Block malware that we have previously identified: Known-malware blocking is signature/reputation enforcement. Cloud Sandbox adds value by analyzing unknown files before a known signature exists.

B. Build a test environment where we can evaluate the result of policies: A test environment for policy evaluation is a lab function. Cloud Sandbox is a malware detonation and behavior-analysis service.

D. Balance threat detection across customers around the world: Balancing detection across customers describes cloud-scale operations. Sandbox’s student-level purpose is to detonate and classify suspicious files.

Intermediate CA rotation reduces exposure if a certificate were mishandled and keeps the inspection trust chain short-lived. Zscaler ' s rotation model for intermediate CA certificates uses a short validity window rather than long-lived static certificates. Option C (Certificates are rotated every seven days and have a 14-day expiration) is correct because the tested rotation policy is seven-day rotation with a fourteen-day expiration.

Why the other options are incorrect:

A. Certificates are rotated every 90 days and have a 180-day expiration: Ninety-day rotation and 180-day expiration would leave intermediate certificates active much longer than the Zscaler inspection model described here.

B. Lifetime certificates have no expiration date: Lifetime certificates would never expire, which is the opposite of good inspection-certificate hygiene. Zscaler uses short-lived intermediate certificates.

D. Certificates are issued dynamically and expire in 24 hours: A 24-hour expiration would be unnecessarily short and is not the documented intermediate CA timing in this exam item.

Answer C is correct. Zscaler Client Connector provides anti-tampering protection for its processes, services, files, and registry keys. For a Windows MSI deployment, the documented installation property is ANTITAMPERING, with the enabled value set during installation. This prevents non-administrator users from stopping, modifying, or deleting protected Zscaler components. Zscaler also provides an Enable Anti-tampering setting in Client Connector App Profiles, including an option governing whether the profile can override the installation parameter. Strict Enforcement serves a different purpose: it controls whether users can access the internet when Client Connector is disabled, signed out, or unable to establish the required tunnel. TamperProofing and DisableTampering are not documented Forwarding Profile controls. See Zscaler’s anti-tampering guidance and Windows installation options.

Z-Tunnel with Local Proxy creates a local loopback proxy on the endpoint. Applications send traffic to that loopback listener, and Client Connector then forwards the traffic toward Zscaler according to profile and policy. Option C (ZTunnel with Local Proxy) is correct because the loopback address behavior is specific to ZTunnel with Local Proxy.

Why the other options are incorrect:

A. Enforced PAC mode: Enforced PAC pushes proxy rules to the system or browser. The loopback forwarding behavior is specifically Tunnel with Local Proxy.

B. ZTunnel - Packet Filter Based: Z-Tunnel is Client Connector tunneling used to steer endpoint traffic to the Zscaler cloud.

D. ZTunnel - Route Based: Z-Tunnel is Client Connector tunneling used to steer endpoint traffic to the Zscaler cloud.

Z-Tunnel 2.0 extends forwarding beyond web proxy traffic by securing all IP unicast traffic through DTLS/TLS tunnels to the Zero Trust Exchange. This enables Cloud Firewall and other controls to inspect all TCP and UDP ports, and ICMP where supported, rather than only browser HTTP/HTTPS flows. Option C (All TCP and UDP ports as well as ICMP traffic) is correct because Tunnel 2.0 is the all-ports-and-protocols forwarding model for Client Connector.

Why the other options are incorrect:

A. TCP ports 80, 443 and 8080 only: Ports 80, 443, and 8080 describe common web proxy traffic. Tunnel 2.0 forwards broader IP traffic, including TCP, UDP, and ICMP.

B. Any HTTP/HTTPS traffic as well as DNS: DNS resolves names to IP addresses; it is a support service, not an access protocol or scoring engine by itself.

D. All Web ports as well as FTP and SSH: RDP, SSH, and VNC are privileged remote access protocols for desktop, shell, and graphical administration.

A watering-hole attack compromises a legitimate website or service that the intended victims already trust and commonly visit. The attacker plants malicious active content, such as injected JavaScript or exploit code, so users are infected during normal browsing instead of being lured to an obviously suspicious site. The answer is Option D (Watering hole attack) because it specifically describes malware hosted on a commonly accessed service, which is the defining trait of this attack type.

Why the other options are incorrect:

A. Remote access trojans: A remote access trojan gives an attacker interactive control over a compromised host after infection.

B. Phishing: Phishing starts with social engineering: fake messages, links, or login pages. The question describes a legitimate common website being seeded with malicious JavaScript.

C. Exploit kits: Exploit kits automate exploitation after a victim reaches malicious content. They can be used inside an attack chain, but the scenario is naming the watering-hole delivery pattern.

Option C tests both the observed behavior and the controls needed to see it. Zscaler notes that attackers use SSL/TLS to conceal data exfiltration and command-and-control traffic, making decryption and inspec tion necessary for visibility. The Web Insights filters distinguish TLS-inspected from uninspected transactions, so the team can confirm whether suspicious outbound flows were actually decrypted. ZIA threat and DLP evidence should be correlated with ZPA user-activity fields to identify unusual private-application access by the same user or device. The team should then verify that DLP and botnet policies covered those decrypted sessions and review any exceptions. Option B examines only part of the evidence. Raising firewall severity changes labeling rather than validating protection, while broad Sandbox reanalysis focuses on downloaded files and does not confirm encrypted egress coverage. Correlation plus policy validation reveals the actual control gap.

Security exception allow lists in Advanced Threat Protection are used with sandbox handling to exempt or control specific traffic from sandbox analysis behavior. They are not URL-filter, file-type, or IPS policy definitions themselves. Option A (Sandbox) is correct because the exception list applies to Sandbox policy behavior.

Why the other options are incorrect:

B. URL Filtering: URL Filtering controls web destinations by category, URL, risk, and action such as allow, block, caution, or isolate.

C. File Type Control: File Type Control classifies and restricts uploads or downloads by file type, regardless of filename tricks.

D. IPS Control: IPS inspects traffic inline for exploit signatures and attack patterns, then blocks or resets offending sessions.

For modern SaaS and web applications, Cloud Application policies usually provide more precise access control than broad URL categories. They can distinguish applications and activities rather than treating the destination as only a URL category. Option A (Cloud Application policies provide better access control) is correct because Cloud Application policies provide deeper application-aware control.

Why the other options are incorrect:

B. URL filtering policies provide better access control: URL Filtering controls web destinations by category, URL, risk, and action such as allow, block, caution, or isolate.

C. Wherever possible URL policies are recommended: URL policies are still useful for category-based web filtering. For SaaS applications, Cloud Application policies provide richer application and activity awareness.

D. Both provide the same filtering capabilities: The two policy types are not equivalent. URL Filtering is destination/category focused, while Cloud App Control understands SaaS apps and actions.

The evidence identifies a network-path problem rather than an application-category or identity problem. Zscaler’s Cloud Path documentation provides end-to-end visibility into latency, packet loss, and jitter, while its tunnel-information guidance shows the tunnel path between Client Connector and the relevant Service Edge. Selecting a nearer or better-performing Service Edge can shorten the impaired path, but the administrator must validate the new route in ZDX and confirm that jitter, loss, and client-egress latency decline during concurrent calls. URL categories do not influence packet loss. Reducing identity claims does not address the ISP spikes already shown in telemetry. Moving a business application to a lower bandwidth class could increase competition and variability. Option B uses the observed fault domain to guide and verify a targeted routing correction.