ZDTA CERTIFICATION SCRIPT 2026
QUESTIONS WITH SOLUTIONS
GRADED A+
◍ What is used to detect if a SAML assertion was modified after being
issued?Options:- XML- Digital Signatures- Attributes- Tokens.
Answer: Digital Signatures
◍ How is a SAML assertion delivered to Zscaler?Options:- The IdP sends it
via an HTTP post directly to the SP via a backend API- The SP sends it via
an HTTP post directly to the IdP via a backend API- The IdP sends it via the
user's browser to the SP- The SP sends it via a trusted authority to the IdP.
Answer: The IdP sends it via the user's browser to the SP(Uses a form POST
submitted via JavaScript)
◍ In what way does Zscaler's Identity Proxy enable authentication to SaaS
applications?Options:- Injecting identity headers into the HTTP request-
SSL Inspection- Browser Isolation- Issuing SAML assertions.
Answer: Issuing SAML assertions
◍ How does Zscaler Internet Access authenticate users? (Select 3)Options:-
SAML- SCIM- LDAP- Hosted Database.
Answer: SAML, LDAP, Hosted Database
◍ How does Zscaler Private Access authenticate end users?Options:-
Username and Password in a form-based auth- Hosted DB- SAML- SCIM.
Answer: SAML
◍ What happens after the Zscaler Client Connector receives a valid SAML
response from the Identity Provider (IdP)?
A. The Zscaler Client Connector Portal authenticates the user directly.
B. There is no need for further actions as the SAML is valid, access is
, granted immediately.
C. The SAML response is sent back to the user's device for local validation.
D. Zscaler Internet Access validates the SAML response and returns an
authentication token..
Answer: D. Zscaler Internet Access validates the SAML response and
returns an authentication token.
◍ You recently deployed an additional App Connector to and existing app
connector group. What do you need to do before starting the zpa-connector
service?
A. Copy the group provisioning key to /opt/zscaler/var/provision key
B. Monitor the peak CPU and memory utilization of the App Connector
C. Schedule periodic software updates for the agg connector group
D. Check the status of the new App Connector in the administration porta.
Answer: A. Copy the group provisioning key to /opt/zscaler/var/provision
key
◍ For a deployment using both ZIA and ZPA set of services, what is the best
authentication solution?
A. Use forms Authentication in ZPA and SAML in ZIA Use forms
B. Authentication in ZIA and SAML in ZPA
C. Configure Authentication using SAML on both ZIA and ZPA
D. Use forms Authentication for both ZIA and ZPA.
Answer: C. Configure Authentication using SAML on both ZIA and ZPA
◍ Which type of attack plants malware on commonly accessed services?
A. Remote access trojans
B. Phishing
C. Exploit kits
D. Watering hole attack.
Answer: D. Watering hole attack
◍ What is the fastest way to change a user's access entitlements?.
Answer: Send different attributes via SCIM
◍ In order for Zscaler to enforce policy based on accessing devices, what
, method is best used by IdPs to share information about a user's accessing
device?Options- Kerberos- SAML- Header Injection- Mobile Device
Management.
Answer: SAML
◍ Which of the following is a key feature of Zscaler Data Protection?
A. Data loss prevention
B. Stopping reconnaissance attacks
C. DDoS protection
D. Log analysis.
Answer: A. Data loss prevention
◍ Cross-Site Scripting (XSS) attacks are a type of injection, in which
malicious scripts are injected into otherwise benign and trusted websites.
XSS includes which of the following?
A. Spyware Callback
B. Anonymizers
C. Cookie Stealing
D. IRC Tunneling.
Answer: C. Cookie Stealing
◍ A user has opened a support case to complain about poor user experience
when trying to manage their AWS resources. How could a helpdesk
administrator get a useful root cause analysis to help isolate the issue in the
least amount of time?
A. Check the Zscaler Trust page for any indications of cloud outages or
incidents that would be causing a slowdown.
B. Check the user's ZDX score for a period of low score for AWS and use
Analyze Score to get the ZDX Y-Engine analysis.
C. Do a Deep Trace on the user's traffic and check for excessive DNS
resolution times and other slowdowns.
D. Initiate a packet capture from Zscaler Client Connector and escalate the
case to have the trace analyzed for root cause..
Answer: D. Initiate a packet capture from Zscaler Client Connector and
, escalate the case to have the trace analyzed for root cause.
◍ Within ZPA, the mapping relationship between Connector Groups and
Server Groups can best be defined as which of the following?
A. Server Groups are configured for Dynamic Server Discovery so that
mapped Connector Groups can then DNS resolve individual application
Segment Groups.
B. Connector Groups are configured for Dynamic Server Discovery so that
mapped Server Groups can DNS resolve and advertise the applications.
C. Connector Groups are configured for Dynamic Server Discovery so that
ZPA can steer traffic through the appropriate Server Group.
D. Server Groups are configured for Dynamic Server Discovery so that
mapped Connector Groups can DNS resolve and make health checks toward
the application..
Answer: D. Server Groups are configured for Dynamic Server Discovery so
that mapped Connector Groups can DNS resolve and make health checks
toward the application.
◍ What is the ZIA feature that ensures certain SaaS applications cannot be
accessed from an unmanaged device?
A. Tenant Restriction
B. Identity Proxy
C. Out-of-band Application Access
D. SaaS Application Access.
Answer: A. Tenant Restriction
◍ Privileged Remote Access supports which protocols? (Select 2)Options:-
SSH- RDP- CIFS- HTTP/HTTPS.
Answer: SSH, RDP
◍ Which services can coexist on an Application Segment?Options:- Isolation,
Browser Access, and Inspection- RDP, SSH, and Inspection- Inspection,
Isolation, and RDP- CIFS, RDP, and SSJ.
Answer: Isolation, Browser Access, and Inspection
◍ Which proprietary technology does Zscaler use to calculate risk attributes
QUESTIONS WITH SOLUTIONS
GRADED A+
◍ What is used to detect if a SAML assertion was modified after being
issued?Options:- XML- Digital Signatures- Attributes- Tokens.
Answer: Digital Signatures
◍ How is a SAML assertion delivered to Zscaler?Options:- The IdP sends it
via an HTTP post directly to the SP via a backend API- The SP sends it via
an HTTP post directly to the IdP via a backend API- The IdP sends it via the
user's browser to the SP- The SP sends it via a trusted authority to the IdP.
Answer: The IdP sends it via the user's browser to the SP(Uses a form POST
submitted via JavaScript)
◍ In what way does Zscaler's Identity Proxy enable authentication to SaaS
applications?Options:- Injecting identity headers into the HTTP request-
SSL Inspection- Browser Isolation- Issuing SAML assertions.
Answer: Issuing SAML assertions
◍ How does Zscaler Internet Access authenticate users? (Select 3)Options:-
SAML- SCIM- LDAP- Hosted Database.
Answer: SAML, LDAP, Hosted Database
◍ How does Zscaler Private Access authenticate end users?Options:-
Username and Password in a form-based auth- Hosted DB- SAML- SCIM.
Answer: SAML
◍ What happens after the Zscaler Client Connector receives a valid SAML
response from the Identity Provider (IdP)?
A. The Zscaler Client Connector Portal authenticates the user directly.
B. There is no need for further actions as the SAML is valid, access is
, granted immediately.
C. The SAML response is sent back to the user's device for local validation.
D. Zscaler Internet Access validates the SAML response and returns an
authentication token..
Answer: D. Zscaler Internet Access validates the SAML response and
returns an authentication token.
◍ You recently deployed an additional App Connector to and existing app
connector group. What do you need to do before starting the zpa-connector
service?
A. Copy the group provisioning key to /opt/zscaler/var/provision key
B. Monitor the peak CPU and memory utilization of the App Connector
C. Schedule periodic software updates for the agg connector group
D. Check the status of the new App Connector in the administration porta.
Answer: A. Copy the group provisioning key to /opt/zscaler/var/provision
key
◍ For a deployment using both ZIA and ZPA set of services, what is the best
authentication solution?
A. Use forms Authentication in ZPA and SAML in ZIA Use forms
B. Authentication in ZIA and SAML in ZPA
C. Configure Authentication using SAML on both ZIA and ZPA
D. Use forms Authentication for both ZIA and ZPA.
Answer: C. Configure Authentication using SAML on both ZIA and ZPA
◍ Which type of attack plants malware on commonly accessed services?
A. Remote access trojans
B. Phishing
C. Exploit kits
D. Watering hole attack.
Answer: D. Watering hole attack
◍ What is the fastest way to change a user's access entitlements?.
Answer: Send different attributes via SCIM
◍ In order for Zscaler to enforce policy based on accessing devices, what
, method is best used by IdPs to share information about a user's accessing
device?Options- Kerberos- SAML- Header Injection- Mobile Device
Management.
Answer: SAML
◍ Which of the following is a key feature of Zscaler Data Protection?
A. Data loss prevention
B. Stopping reconnaissance attacks
C. DDoS protection
D. Log analysis.
Answer: A. Data loss prevention
◍ Cross-Site Scripting (XSS) attacks are a type of injection, in which
malicious scripts are injected into otherwise benign and trusted websites.
XSS includes which of the following?
A. Spyware Callback
B. Anonymizers
C. Cookie Stealing
D. IRC Tunneling.
Answer: C. Cookie Stealing
◍ A user has opened a support case to complain about poor user experience
when trying to manage their AWS resources. How could a helpdesk
administrator get a useful root cause analysis to help isolate the issue in the
least amount of time?
A. Check the Zscaler Trust page for any indications of cloud outages or
incidents that would be causing a slowdown.
B. Check the user's ZDX score for a period of low score for AWS and use
Analyze Score to get the ZDX Y-Engine analysis.
C. Do a Deep Trace on the user's traffic and check for excessive DNS
resolution times and other slowdowns.
D. Initiate a packet capture from Zscaler Client Connector and escalate the
case to have the trace analyzed for root cause..
Answer: D. Initiate a packet capture from Zscaler Client Connector and
, escalate the case to have the trace analyzed for root cause.
◍ Within ZPA, the mapping relationship between Connector Groups and
Server Groups can best be defined as which of the following?
A. Server Groups are configured for Dynamic Server Discovery so that
mapped Connector Groups can then DNS resolve individual application
Segment Groups.
B. Connector Groups are configured for Dynamic Server Discovery so that
mapped Server Groups can DNS resolve and advertise the applications.
C. Connector Groups are configured for Dynamic Server Discovery so that
ZPA can steer traffic through the appropriate Server Group.
D. Server Groups are configured for Dynamic Server Discovery so that
mapped Connector Groups can DNS resolve and make health checks toward
the application..
Answer: D. Server Groups are configured for Dynamic Server Discovery so
that mapped Connector Groups can DNS resolve and make health checks
toward the application.
◍ What is the ZIA feature that ensures certain SaaS applications cannot be
accessed from an unmanaged device?
A. Tenant Restriction
B. Identity Proxy
C. Out-of-band Application Access
D. SaaS Application Access.
Answer: A. Tenant Restriction
◍ Privileged Remote Access supports which protocols? (Select 2)Options:-
SSH- RDP- CIFS- HTTP/HTTPS.
Answer: SSH, RDP
◍ Which services can coexist on an Application Segment?Options:- Isolation,
Browser Access, and Inspection- RDP, SSH, and Inspection- Inspection,
Isolation, and RDP- CIFS, RDP, and SSJ.
Answer: Isolation, Browser Access, and Inspection
◍ Which proprietary technology does Zscaler use to calculate risk attributes
