ZDTA COMPREHENSIVE ANSWERS AND QUESTIONS
SET A+
✔✔Forwarding Profile PAC files - ✔✔Steering traffic toward or away from the Client
Connector.
✔✔App Profile PAC files - ✔✔They steer traffic towards or away from the Zscaler Cloud
after the Client Connector receives it.
✔✔Forwarding Profile PAC purpose - ✔✔It states which HTTP proxy is going to be
used for a specific URL.
✔✔Application Profile PAC routing - ✔✔It routes traffic after interception and determines
the geographically closest Zscaler Enforcement Node (ZEN).
✔✔PAC files on ZIA Admin Portal - ✔✔They take a URL and a host as input and return
an answer of sending the traffic 'DIRECT' or 'PROXY'.
✔✔Migrating existing PAC files to Zscaler - ✔✔By using Tunnel with Local Proxy and
configuring the browser to treat Zscaler Client Connector as a proxy.
✔✔Browser behavior in PAC to tunnel mode - ✔✔The browser will lose the definition of
what constitutes an intranet site, potentially prompting user authentication for intranet
sites.
✔✔Defining intranet sites in tunnel mode - ✔✔By explicitly defining them within the
intranet zone and using configurations like the AuthServerAllowList.
✔✔Key characteristic of ZTunnel 2.0 - ✔✔It can include or exclude traffic at the adapter
level and pass it into the Z-Tunnel 2.0.
✔✔Z-Tunnel 1.0 interception - ✔✔Traffic at the network layer on ports 80 or 443.
,✔✔Tunnel with Local Proxy configuration requirement - ✔✔A Forwarding Profile PAC to
target traffic directly to the local listener on Zscaler Client Connector.
✔✔Traffic routing in route-based mode - ✔✔Through a routed adapter configured on
the machine, following the routing table.
✔✔Application PAC role in route-based mode - ✔✔It processes the traffic and routes it
either to the Zscaler cloud or directly to the internet.
✔✔Tunnel 2.0 configuration exclusion - ✔✔The RFC 1918 address space.
✔✔Handling DNS requests by Zscaler - ✔✔They are tunneled to the Zscaler cloud for
DNS resolution.
✔✔Forwarding Profile PAC control - ✔✔The system PAC file and the HTTP proxy to be
used for a URL.
✔✔Result of using Forwarding Profile PAC for local proxy - ✔✔It points traffic at the
loopback address or another explicit proxy.
✔✔Primary function of an App Profile PAC - ✔✔To steer traffic towards or away from
the Zscaler cloud.
✔✔Zscaler DNS resolution - ✔✔By intercepting DNS requests and redirecting them to
the Zscaler cloud.
✔✔Seamless authentication to intranet sites in tunnel mode - ✔✔Define intranet sites in
the browser configuration, such as the intranet zone and AuthServerAllowList.
✔✔Non-80 and non-443 traffic in Z-Tunnel 1.0 - ✔✔It bypasses Zscaler Client
Connector and routes directly to the internet.
✔✔Tunnel with Local Proxy configuration reliance - ✔✔Proxy-aware applications that
understand the Zscaler Client Connector.
✔✔First step when launching Zscaler Client Connector - ✔✔The first step is to enroll
and authenticate to understand the user, apply policy, create tunnels, and identify the
user through those tunnels.
✔✔Communication upon launch of Zscaler Client Connector - ✔✔It communicates with
the mobile admin portal (Zscaler Client Connector Portal) to understand the user's
domain and SAML identity provider.
, ✔✔After IdP redirect - ✔✔The user is redirected to their SAML IdP (e.g., Okta, ADFS,
Azure AD), signs in, and receives a SAML response within Zscaler Client Connector.
✔✔Zscaler Internet Access with SAML response - ✔✔It consumes the response,
validates it, and if valid, sends an authentication token back to Zscaler Client Connector.
✔✔Zscaler Client Connector with authentication token - ✔✔It provides the token to the
Zscaler Client Connector Portal, which validates the token and registers the device.
✔✔Information passed to Zscaler Internet Access - ✔✔The portal passes device
registration information to Zscaler Internet Access.
✔✔Credentials provided after enrollment - ✔✔It provides client credentials for
authenticating user requests through the Zscaler service.
✔✔Initial step in Zscaler Private Access (ZPA) enrollment - ✔✔The client is launched as
part of the authentication process, understanding the user's domain from Zscaler
Internet Access enrollment.
✔✔Second IdP redirect in ZPA enrollment - ✔✔Zscaler Client Connector talks to the
SAML IdP, signs in transparently, and may undergo multifactor authentication.
✔✔SAML response in ZPA enrollment - ✔✔It provides the response token and registers
the device into Zscaler Client Connector Portal.
✔✔Zscaler Private Access after device registration - ✔✔It generates Zscaler Client
Connector certificates and enrolls the device in Zscaler Private Access.
✔✔Zscaler Client Connector after ZPA enrollment - ✔✔It generates secure tunnels to
the Zero Trust Exchange for downloading profiles and settings.
✔✔Network change in Zscaler Client Connector - ✔✔It performs a full refresh of
applications, app profiles, forwarding profiles, PAC files, and policy.
✔✔Zscaler Client Connector software update check frequency - ✔✔Every two hours.
✔✔Zscaler Client Connector policy update download frequency - ✔✔Every hour.
✔✔Zscaler Client Connector PAC file download frequency - ✔✔Every 15 minutes.
✔✔Manual update initiation in Zscaler Client Connector - ✔✔Through the administration
interface to force a check for software updates or policy changes.
SET A+
✔✔Forwarding Profile PAC files - ✔✔Steering traffic toward or away from the Client
Connector.
✔✔App Profile PAC files - ✔✔They steer traffic towards or away from the Zscaler Cloud
after the Client Connector receives it.
✔✔Forwarding Profile PAC purpose - ✔✔It states which HTTP proxy is going to be
used for a specific URL.
✔✔Application Profile PAC routing - ✔✔It routes traffic after interception and determines
the geographically closest Zscaler Enforcement Node (ZEN).
✔✔PAC files on ZIA Admin Portal - ✔✔They take a URL and a host as input and return
an answer of sending the traffic 'DIRECT' or 'PROXY'.
✔✔Migrating existing PAC files to Zscaler - ✔✔By using Tunnel with Local Proxy and
configuring the browser to treat Zscaler Client Connector as a proxy.
✔✔Browser behavior in PAC to tunnel mode - ✔✔The browser will lose the definition of
what constitutes an intranet site, potentially prompting user authentication for intranet
sites.
✔✔Defining intranet sites in tunnel mode - ✔✔By explicitly defining them within the
intranet zone and using configurations like the AuthServerAllowList.
✔✔Key characteristic of ZTunnel 2.0 - ✔✔It can include or exclude traffic at the adapter
level and pass it into the Z-Tunnel 2.0.
✔✔Z-Tunnel 1.0 interception - ✔✔Traffic at the network layer on ports 80 or 443.
,✔✔Tunnel with Local Proxy configuration requirement - ✔✔A Forwarding Profile PAC to
target traffic directly to the local listener on Zscaler Client Connector.
✔✔Traffic routing in route-based mode - ✔✔Through a routed adapter configured on
the machine, following the routing table.
✔✔Application PAC role in route-based mode - ✔✔It processes the traffic and routes it
either to the Zscaler cloud or directly to the internet.
✔✔Tunnel 2.0 configuration exclusion - ✔✔The RFC 1918 address space.
✔✔Handling DNS requests by Zscaler - ✔✔They are tunneled to the Zscaler cloud for
DNS resolution.
✔✔Forwarding Profile PAC control - ✔✔The system PAC file and the HTTP proxy to be
used for a URL.
✔✔Result of using Forwarding Profile PAC for local proxy - ✔✔It points traffic at the
loopback address or another explicit proxy.
✔✔Primary function of an App Profile PAC - ✔✔To steer traffic towards or away from
the Zscaler cloud.
✔✔Zscaler DNS resolution - ✔✔By intercepting DNS requests and redirecting them to
the Zscaler cloud.
✔✔Seamless authentication to intranet sites in tunnel mode - ✔✔Define intranet sites in
the browser configuration, such as the intranet zone and AuthServerAllowList.
✔✔Non-80 and non-443 traffic in Z-Tunnel 1.0 - ✔✔It bypasses Zscaler Client
Connector and routes directly to the internet.
✔✔Tunnel with Local Proxy configuration reliance - ✔✔Proxy-aware applications that
understand the Zscaler Client Connector.
✔✔First step when launching Zscaler Client Connector - ✔✔The first step is to enroll
and authenticate to understand the user, apply policy, create tunnels, and identify the
user through those tunnels.
✔✔Communication upon launch of Zscaler Client Connector - ✔✔It communicates with
the mobile admin portal (Zscaler Client Connector Portal) to understand the user's
domain and SAML identity provider.
, ✔✔After IdP redirect - ✔✔The user is redirected to their SAML IdP (e.g., Okta, ADFS,
Azure AD), signs in, and receives a SAML response within Zscaler Client Connector.
✔✔Zscaler Internet Access with SAML response - ✔✔It consumes the response,
validates it, and if valid, sends an authentication token back to Zscaler Client Connector.
✔✔Zscaler Client Connector with authentication token - ✔✔It provides the token to the
Zscaler Client Connector Portal, which validates the token and registers the device.
✔✔Information passed to Zscaler Internet Access - ✔✔The portal passes device
registration information to Zscaler Internet Access.
✔✔Credentials provided after enrollment - ✔✔It provides client credentials for
authenticating user requests through the Zscaler service.
✔✔Initial step in Zscaler Private Access (ZPA) enrollment - ✔✔The client is launched as
part of the authentication process, understanding the user's domain from Zscaler
Internet Access enrollment.
✔✔Second IdP redirect in ZPA enrollment - ✔✔Zscaler Client Connector talks to the
SAML IdP, signs in transparently, and may undergo multifactor authentication.
✔✔SAML response in ZPA enrollment - ✔✔It provides the response token and registers
the device into Zscaler Client Connector Portal.
✔✔Zscaler Private Access after device registration - ✔✔It generates Zscaler Client
Connector certificates and enrolls the device in Zscaler Private Access.
✔✔Zscaler Client Connector after ZPA enrollment - ✔✔It generates secure tunnels to
the Zero Trust Exchange for downloading profiles and settings.
✔✔Network change in Zscaler Client Connector - ✔✔It performs a full refresh of
applications, app profiles, forwarding profiles, PAC files, and policy.
✔✔Zscaler Client Connector software update check frequency - ✔✔Every two hours.
✔✔Zscaler Client Connector policy update download frequency - ✔✔Every hour.
✔✔Zscaler Client Connector PAC file download frequency - ✔✔Every 15 minutes.
✔✔Manual update initiation in Zscaler Client Connector - ✔✔Through the administration
interface to force a check for software updates or policy changes.
