Tenant Restriction lets ZIA distinguish the approved corporate tenant of a SaaS application from personal or unmanaged tenants. That matters when the user is on an unmanaged device, because the administrator may allow the corporate tenant only from trusted or managed contexts. Option A (Tenant Restriction) is correct because Tenant Restriction is the SaaS-specific control that enforces corporate-tenant access boundaries.
Why the other options are incorrect:
B. Identity Proxy: Identity Proxy helps broker identity and authentication flows for SaaS access. Tenant Restriction is the control that separates corporate SaaS tenants from personal ones.
C. Out-of-band Application Access: Out-of-band CASB works through SaaS APIs to inspect or remediate content already sitting inside cloud applications.
D. SaaS Application Access: SaaS Application Access is a broad access concept. The specific ZIA feature that blocks unmanaged-device access to a SaaS tenant is Tenant Restriction.
Chris Miller
23-Jun-2026
The ZDTA (Zscaler Digital Transformation Administrator) certification is vital in today's security landscape. Examstrack.coms Practice Test was exceptional, accurately reflecting the exam's focus on Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) functionalities. The exact questions provided insight into policy configuration, traffic forwarding, and troubleshooting. Thanks to Examstrack.com, I passed and advanced my career. A definite success guarantee!
