Learn with Zscaler : ZDTA training material for 100% pass

A microsegmentation policy set contains a broad "allow employees to internal applications" rule before more specific controls. An incident review found SMB access from non-finance hosts to a finance file share.
Which refinement best addresses the unintended access while improving the internal security posture?

• A. Reorder the rules so the deny for non-finance SMB is evaluated before broad employee allows, and scope the SMB policy to finance hosts and device posture
• B. Insert deception assets in the finance segment to divert suspicious SMB traffic away from the file share and collect telemetry
• C. Tighten URL Filtering for internal destinations so SMB-related domains resolve poorly in non-finance contexts
• D. Add bandwidth QoS constraints to the internal applications segment so non-finance SMB attempts are deprioritized at runtime

A device connects to the Zero Trust Exchange with missing antivirus telemetry and an unverified client certificate in its posture profile.
Assuming Leading Practice for posture-driven enforcement are implemented, what is the outcome for the session?

• A. Route to the nearest service edge and record a posture exception in logs
• B. Defer the decision to the identity provider due to incomplete posture telemetry
• C. Apply an isolation policy that constrains interaction until posture is compliant
• D. Treat the session as trusted because the network context is corporate Wi-Fi

When correlating indicators of privilege escalation with administrator behavior, which log type provides the most direct visibility into role changes and entitlement modifications for administrative accounts?

• A. Endpoint DLP telemetry summarizing sensitive-data handling and removable-media events
• B. Firewall Insights reports centered on rule hits and bandwidth consumption at egress points
• C. Web Insights transaction logs focusing on URL categories and inline policy actions
• D. ZIdentity Administrator Audit Log filtered for entitlement updates and role assignments

Traffic from a remote office traverses an untrusted ISP path and must connect to Zscaler through a mapped location with a defined static IP address and an expected throughput of 300 Mbps. High availability is not required.
Which action provides the appropriate tunnel characteristics with the minimum number of tunnels?

• A. Build two IPSec tunnels with relaxed Dead Peer Detection (DPD) timers to avoid flapping during transient ISP outages
• B. Deploy a GRE tunnel with aggressive keepalives to compensate for underlay instability, and assign the static IP address to the location
• C. Configure a single IPSec tunnel to a regional Service Edge, and configure the location's static IP address and bandwidth expectation
• D. Implement two GRE tunnels to different Service Edges and rely on SD-WAN latency scoring to steer traffic

What must new administrators in ZIdentity be assigned to perform administrative functions for Zscaler products?

• A. Administrative Entitlements
• B. Just-in-Time (JIT) provisioning
• C. Environments
• D. Service Entitlements