ZDTA Questions and Answers

TLS Inspection in Zscaler Internet Access secures public internet browsing bycreating intermediate certificates for each client connection. This Man-In-The-Middle approach enables Zscaler to decrypt and inspect encrypted traffic for threats and policy compliance while still maintaining secure connections with the client. The intermediate certificate acts as a trusted entity between the client and the real server during inspection.

Tenant Restrictionis the ZIA feature that enforces access control policies to prevent access to certain SaaS applications from unmanaged or non-compliant devices. This ensures that only authorized and managed devices can access sensitive corporate SaaS resources, enhancing security posture.

The study guide highlights Tenant Restriction as an essential control for enforcing device compliance in SaaS access policies.

The recommended minimum number of App connectors to ensure resiliency in Zscaler Private Access is2. Having at least two App connectors provides redundancy, so if one connector fails or is unavailable, the other can continue to provide access without interruption. This recommendation is critical to maintaining high availability and fault tolerance for internal application access.

The study guide specifies this minimum to ensure continuity and reliability of application access through ZPA.

The valid Malware Protection setting selectable when configuring a Malware Policy in Zscaler isBlock. This setting instructs the platform to block malicious files or activities detected by malware scanning engines.

Other settings like Isolate or Bypass are not standard malware policy actions in Zscaler’s malware protection configuration. The “Do Not Decrypt” option relates to SSL inspection settings, not malware policy actions. The study guide specifies “Block” as the primary malware policy action to enforce protection.

In the Zscaler Zero Trust Exchange Functional Services Diagram,Antivirus is categorized under Security Services. Security Services include tools and mechanisms that inspect and enforce security on traffic, such as antivirus scanning, firewall controls, and data loss prevention. These services are core components for detecting and mitigating threats across internet-bound traffic.

Zscaler supportsRDP, VNC, and SSHprotocols for Privileged Remote Access. These are commonly used protocols for remote management and privileged user sessions, allowing secure access to internal applications or systems without exposing the network or requiring VPN connections.

The study guide clearly states that Privileged Remote Access capabilities focus on these protocols to ensure secure, monitored, and controlled remote sessions for administrators and privileged users, supporting remote desktop and shell access securely .

Advanced Threat Protection (ATP) defends users frommalicious active content, which includes malware, exploit kits, malicious scripts, and other forms of active content designed to compromise user systems. ATP employs multiple techniques such as sandboxing, malware scanning, and threat intelligence to detect and block these threats before they reach the user.

AWatering Hole Attackis characterized by attackers planting malware on websites or services that are commonly accessed by their intended victims. The goal is to infect users who visit these trusted sites by injecting malicious code or malware. This type of attack leverages the trust users place in frequently visited services to deliver malware covertly.

Other options like Remote Access Trojans, Phishing, and Exploit Kits are attack types but do not specifically involve compromising commonly accessed services to plant malware.

ZscalerAdvanced FirewallsupportsDNS Tunnel and DNS Application Control, capabilities that are not available in the Standard Firewall. This enhances detection and control of DNS-based threats and allows granular enforcement over DNS queries and responses to prevent data exfiltration and command and control activities.

Theuser risk scoreenables organizations toconfigure stronger user-specific policies to monitor and control user-level risk exposure. This score reflects a user's risk posture based on behaviors and detected anomalies and helps in tailoring security policies to address individual risk levels.

While the score gives insight into user risk, it is primarily designed for adaptive policy enforcement rather than direct compromise detection or cross-company comparison. The study guide highlights that user risk scores drive policy adjustments to better secure user activity.

A Watering Hole Attack targets users by compromising a website or service that is commonly visited by the intended victims. The attacker injects malicious content such as malicious JavaScript or malware into the website, so when the user visits the site, their system gets infected. This attack relies on the trust users have in popular or legitimate websites and exploits it by turning those sites into infection vectors.

Pre-existing Compromise refers to attacks where the target environment is already compromised before the attack is recognized, but it does not specifically describe malicious content injected intopopular websites. Phishing Attack involves deceiving users to click malicious links or reveal credentials, not compromising websites directly. Exploit Kits are automated tools that scan for vulnerabilities and deliver exploits but are not characterized by the use of commonly used websites hosting malicious scripts.

The study guide clearly explains Watering Hole Attacks as a method where attackers infect trusted websites frequented by target users to deliver malicious payloads.

Certificate pinning prevents SSL interception by validating a server’s certificate against known values. When ZIA performs SSL inspection, it substitutes the certificate with one signed by Zscaler’s CA. This causes the handshake to fail for pinned applications. To troubleshoot, an administrator shouldreview SSL logs to identify handshake failures, which indicate certificate pinning issues. Logs will show the TLS negotiation details, including any disruptions.

Zscaler uses a proprietary technology calledZscaler PageRiskto calculate risk attributes dynamically for websites. PageRisk assesses the risk level of a website based on a variety of dynamic factors, including the site's content, reputation, and behavior, helping to identify potentially harmful or suspicious sites in real time.

This dynamic risk scoring allows Zscaler to enforce security policies more effectively, blocking or allowing access based on calculated risk rather than static lists alone. The study guide specifies that PageRisk is integral to the platform's adaptive security posture and URL filtering capabilities .