ZDTA UPDATED 2027 ANSWERS AND QUESTIONS
SET A+
✔✔Use of ZSATunnel logs - ✔✔To inspect the connection to service edge, Zscaler
Client Connector Portal, or any application being accessed.
✔✔Information from ip.zscaler.com - ✔✔Information about whether the user is going
through Zscaler service.
✔✔How to collect SAML logs via browser extensions - ✔✔Use SAML Message
Decoder from Chrome or Firefox Add-ons Manager.
✔✔Role of Zscaler Global Customer Service Engineers in the Knowledge Base -
✔✔They maintain documentation on specific symptoms and solutions.
✔✔First step in the Zscaler troubleshooting process - ✔✔Localize the issue.
✔✔Usefulness of checking the Zscaler Trust page when facing service issues - ✔✔It
can save troubleshooting time and effort by providing current service status and
incidents.
✔✔Zero Trust Exchange - ✔✔To securely connect users and applications while
enforcing security controls.
✔✔Zero Trust Connectivity - ✔✔Zero trust connections are independent of any network
for control or trust.
✔✔Zscaler Client Connector - ✔✔A lightweight app that enforces security policies and
access controls on user endpoints.
✔✔Zscaler Client Connector Enforcement - ✔✔By creating a tunnel to the Zero Trust
Exchange for protecting SaaS and internet-bound traffic.
,✔✔App Connectors - ✔✔Secure authenticated interfaces between customer servers
and the ZPA cloud.
✔✔Browser Access - ✔✔Provides connectivity through a web browser to HTTP and
HTTPS applications without installing Zscaler Client Connector.
✔✔ZTunnel - Packet Filter Based mode - ✔✔A mode that creates packet filters on
Windows to steer traffic towards the Zscaler Client Connector.
✔✔ZTunnel - Route-Based mode - ✔✔It creates route table entries and instruments an
additional network adapter for traffic routing.
✔✔ZTunnel with Local Proxy - ✔✔A mode that deploys a system proxy to localhost,
directing traffic to the Zscaler cloud.
✔✔ZTunnel 1.0 vs ZTunnel 2.0 - ✔✔ZTunnel 1.0 uses HTTP CONNECT method, while
ZTunnel 2.0 uses DTLS with fallback to TLS, supporting all client traffic.
✔✔Trusted Network Detection - ✔✔To determine if a user is on a trusted network based
on criteria like hostname, IP address, and DNS servers.
✔✔Authenticated Tunnel Options - ✔✔ZTunnel - Packet Filter Based, ZTunnel - Route-
Based, and ZTunnel with Local Proxy.
✔✔ZTunnel 2.0 Advantage - ✔✔ZTunnel 2.0 supports DTLS for faster transport and
provides a control channel for real-time updates.
✔✔Traffic Handling in ZTunnel - ✔✔It intercepts traffic at the network level and forwards
it through an encapsulated tunnel to the Zscaler platform.
✔✔Browser-based Access Capability - ✔✔Access to HTTP and HTTPS applications as
well as privileged remote access applications without the need for Zscaler Client
Connector.
✔✔Zscaler Client Connector Feature - ✔✔It provides a consistent experience across all
platforms with strict enforcement options.
✔✔User Attribution in Zscaler Client Connector - ✔✔Through transparent authentication
and the installation of Zscaler or custom SSL inspection certificates.
✔✔Hostname and IP in Trusted Network Detection - ✔✔To determine if a specific
FQDN resolves to an IP address, indicating a trusted network.
,✔✔DNS Search Domains in Trusted Network Detection - ✔✔By matching the DNS
search domain provided by DHCP with the trusted network criteria.
✔✔DNS Server Criteria Importance - ✔✔The client checks if the primary network
adapter's DNS server matches the trusted network configuration.
✔✔Multiple Trusted Networks Purpose - ✔✔To make decisions on which forwarding
profile matches the desired outcome for different networks.
✔✔Forwarding Profile Utilization - ✔✔By selecting trusted network criteria from a
predefined list to apply to the forwarding profile.
✔✔Best Practices for Forwarding Profiles - ✔✔Use tunnel mode, specifically ZTunnel
2.0, to capture all traffic and tunnel it to Zscaler within a DTLS tunnel.
✔✔Default Configuration in ZTunnel 2.0 - ✔✔Default to DTLS with the ability to fall back
to TLS as necessary.
✔✔System Proxy Settings Migration Recommendation - ✔✔Enforce a no-proxy
configuration when using tunnel mode.
✔✔Automatically Detect Settings Proxy Action - ✔✔The client sends a WPAD (Web
Proxy Auto-Discovery) lookup to find a proxy.
✔✔Use Automatic Configuration Script Proxy Action - ✔✔Configures the Zscaler Client
Connector to set a custom system PAC file to download and run, explicitly proxying
traffic.
✔✔Use Proxy Server for Your LAN Proxy Action - ✔✔A hard-coded proxy import with
the ability to bypass local addresses.
✔✔GPO Update Purpose in Proxy Settings - ✔✔To provide a GPO update/force from
Active Directory to set the proxy settings on the machine.
✔✔Understanding GPO Updates Importance - ✔✔To avoid conflicts between forcing
proxy settings and using WPAD scripts.
✔✔Forwarding PAC Significance - ✔✔With tunnel mode configuration, avoid setting any
forwarding PAC file to natively intercept traffic and tunnel it to the Zero Trust Exchange.
✔✔Application Profile Function in Zscaler - ✔✔Maps forwarding profiles to different
users and devices based on specific criteria.
, ✔✔App Profile PAC URL Role - ✔✔Defines the Zero Trust Exchange node to be used
based on the client's geographic IP information.
✔✔Custom PAC URL Configuration Item - ✔✔In an application profile.
✔✔Custom PAC URL - ✔✔References the PAC file configured in the ZIA Admin Portal
to make decisions on traffic forwarding or bypassing.
✔✔Override WPAD - ✔✔Prevents the system GPO WPAD configuration and ensures
the forwarding profile's WPAD configuration is used.
✔✔Restart WinHTTP - ✔✔Ensures the system refreshes proxy configuration once
Zscaler Client Connector is established, specific to Windows devices.
✔✔Zscaler SSL Certificate - ✔✔If not pushing own certificates, enabling this option
uses the certificate provided by Zscaler for SSL inspection.
✔✔Tunnel Internal Client Connector Traffic - ✔✔Health updates and policy traffic pass
through Zscaler tunnels towards the Zero Trust Exchange.
✔✔Cache System Proxy - ✔✔Stores the system proxy state from before installation and
reverts to previous settings if the connector is uninstalled or disabled.
✔✔Supportability in Zscaler Client Connector - ✔✔Ensures business continuity in case
of issues with updates, allowing for reverting to previous versions if necessary.
✔✔Zscaler root CA - ✔✔The Zscaler root CA as well as custom root CAs can be
deployed within an organization.
✔✔SSL certificates in app profile - ✔✔Ensuring that the SSL certificate is installed.
✔✔Bypassed applications in Z-Tunnel 2.0 - ✔✔Microsoft Teams or Zoom traffic.
✔✔Default address range in Z-Tunnel 2.0 - ✔✔The default 0.0.0.0/0 address range and
all ports 1 to 65,535 TCP and UDP.
✔✔Zscaler as DNS resolver - ✔✔Zscaler acts as a DNS resolver.
✔✔Handling DNS requests from DHCP - ✔✔The client may query that directly, and
Zscaler will see the traffic once it comes through and make a DNS re-resolution request.
✔✔Forwarding Profile PAC files - ✔✔Steering traffic toward or away from the Client
Connector.
SET A+
✔✔Use of ZSATunnel logs - ✔✔To inspect the connection to service edge, Zscaler
Client Connector Portal, or any application being accessed.
✔✔Information from ip.zscaler.com - ✔✔Information about whether the user is going
through Zscaler service.
✔✔How to collect SAML logs via browser extensions - ✔✔Use SAML Message
Decoder from Chrome or Firefox Add-ons Manager.
✔✔Role of Zscaler Global Customer Service Engineers in the Knowledge Base -
✔✔They maintain documentation on specific symptoms and solutions.
✔✔First step in the Zscaler troubleshooting process - ✔✔Localize the issue.
✔✔Usefulness of checking the Zscaler Trust page when facing service issues - ✔✔It
can save troubleshooting time and effort by providing current service status and
incidents.
✔✔Zero Trust Exchange - ✔✔To securely connect users and applications while
enforcing security controls.
✔✔Zero Trust Connectivity - ✔✔Zero trust connections are independent of any network
for control or trust.
✔✔Zscaler Client Connector - ✔✔A lightweight app that enforces security policies and
access controls on user endpoints.
✔✔Zscaler Client Connector Enforcement - ✔✔By creating a tunnel to the Zero Trust
Exchange for protecting SaaS and internet-bound traffic.
,✔✔App Connectors - ✔✔Secure authenticated interfaces between customer servers
and the ZPA cloud.
✔✔Browser Access - ✔✔Provides connectivity through a web browser to HTTP and
HTTPS applications without installing Zscaler Client Connector.
✔✔ZTunnel - Packet Filter Based mode - ✔✔A mode that creates packet filters on
Windows to steer traffic towards the Zscaler Client Connector.
✔✔ZTunnel - Route-Based mode - ✔✔It creates route table entries and instruments an
additional network adapter for traffic routing.
✔✔ZTunnel with Local Proxy - ✔✔A mode that deploys a system proxy to localhost,
directing traffic to the Zscaler cloud.
✔✔ZTunnel 1.0 vs ZTunnel 2.0 - ✔✔ZTunnel 1.0 uses HTTP CONNECT method, while
ZTunnel 2.0 uses DTLS with fallback to TLS, supporting all client traffic.
✔✔Trusted Network Detection - ✔✔To determine if a user is on a trusted network based
on criteria like hostname, IP address, and DNS servers.
✔✔Authenticated Tunnel Options - ✔✔ZTunnel - Packet Filter Based, ZTunnel - Route-
Based, and ZTunnel with Local Proxy.
✔✔ZTunnel 2.0 Advantage - ✔✔ZTunnel 2.0 supports DTLS for faster transport and
provides a control channel for real-time updates.
✔✔Traffic Handling in ZTunnel - ✔✔It intercepts traffic at the network level and forwards
it through an encapsulated tunnel to the Zscaler platform.
✔✔Browser-based Access Capability - ✔✔Access to HTTP and HTTPS applications as
well as privileged remote access applications without the need for Zscaler Client
Connector.
✔✔Zscaler Client Connector Feature - ✔✔It provides a consistent experience across all
platforms with strict enforcement options.
✔✔User Attribution in Zscaler Client Connector - ✔✔Through transparent authentication
and the installation of Zscaler or custom SSL inspection certificates.
✔✔Hostname and IP in Trusted Network Detection - ✔✔To determine if a specific
FQDN resolves to an IP address, indicating a trusted network.
,✔✔DNS Search Domains in Trusted Network Detection - ✔✔By matching the DNS
search domain provided by DHCP with the trusted network criteria.
✔✔DNS Server Criteria Importance - ✔✔The client checks if the primary network
adapter's DNS server matches the trusted network configuration.
✔✔Multiple Trusted Networks Purpose - ✔✔To make decisions on which forwarding
profile matches the desired outcome for different networks.
✔✔Forwarding Profile Utilization - ✔✔By selecting trusted network criteria from a
predefined list to apply to the forwarding profile.
✔✔Best Practices for Forwarding Profiles - ✔✔Use tunnel mode, specifically ZTunnel
2.0, to capture all traffic and tunnel it to Zscaler within a DTLS tunnel.
✔✔Default Configuration in ZTunnel 2.0 - ✔✔Default to DTLS with the ability to fall back
to TLS as necessary.
✔✔System Proxy Settings Migration Recommendation - ✔✔Enforce a no-proxy
configuration when using tunnel mode.
✔✔Automatically Detect Settings Proxy Action - ✔✔The client sends a WPAD (Web
Proxy Auto-Discovery) lookup to find a proxy.
✔✔Use Automatic Configuration Script Proxy Action - ✔✔Configures the Zscaler Client
Connector to set a custom system PAC file to download and run, explicitly proxying
traffic.
✔✔Use Proxy Server for Your LAN Proxy Action - ✔✔A hard-coded proxy import with
the ability to bypass local addresses.
✔✔GPO Update Purpose in Proxy Settings - ✔✔To provide a GPO update/force from
Active Directory to set the proxy settings on the machine.
✔✔Understanding GPO Updates Importance - ✔✔To avoid conflicts between forcing
proxy settings and using WPAD scripts.
✔✔Forwarding PAC Significance - ✔✔With tunnel mode configuration, avoid setting any
forwarding PAC file to natively intercept traffic and tunnel it to the Zero Trust Exchange.
✔✔Application Profile Function in Zscaler - ✔✔Maps forwarding profiles to different
users and devices based on specific criteria.
, ✔✔App Profile PAC URL Role - ✔✔Defines the Zero Trust Exchange node to be used
based on the client's geographic IP information.
✔✔Custom PAC URL Configuration Item - ✔✔In an application profile.
✔✔Custom PAC URL - ✔✔References the PAC file configured in the ZIA Admin Portal
to make decisions on traffic forwarding or bypassing.
✔✔Override WPAD - ✔✔Prevents the system GPO WPAD configuration and ensures
the forwarding profile's WPAD configuration is used.
✔✔Restart WinHTTP - ✔✔Ensures the system refreshes proxy configuration once
Zscaler Client Connector is established, specific to Windows devices.
✔✔Zscaler SSL Certificate - ✔✔If not pushing own certificates, enabling this option
uses the certificate provided by Zscaler for SSL inspection.
✔✔Tunnel Internal Client Connector Traffic - ✔✔Health updates and policy traffic pass
through Zscaler tunnels towards the Zero Trust Exchange.
✔✔Cache System Proxy - ✔✔Stores the system proxy state from before installation and
reverts to previous settings if the connector is uninstalled or disabled.
✔✔Supportability in Zscaler Client Connector - ✔✔Ensures business continuity in case
of issues with updates, allowing for reverting to previous versions if necessary.
✔✔Zscaler root CA - ✔✔The Zscaler root CA as well as custom root CAs can be
deployed within an organization.
✔✔SSL certificates in app profile - ✔✔Ensuring that the SSL certificate is installed.
✔✔Bypassed applications in Z-Tunnel 2.0 - ✔✔Microsoft Teams or Zoom traffic.
✔✔Default address range in Z-Tunnel 2.0 - ✔✔The default 0.0.0.0/0 address range and
all ports 1 to 65,535 TCP and UDP.
✔✔Zscaler as DNS resolver - ✔✔Zscaler acts as a DNS resolver.
✔✔Handling DNS requests from DHCP - ✔✔The client may query that directly, and
Zscaler will see the traffic once it comes through and make a DNS re-resolution request.
✔✔Forwarding Profile PAC files - ✔✔Steering traffic toward or away from the Client
Connector.
