ZDTA CORRECT EXAMS ANSWERS AND QUESTIONS
SET A+
✔✔These three actions can be pushed out through group policy objects and identified
from your existing PAC file, migrated into the browser configuration, and pushed out
before the migration to Zscaler occurs. - ✔✔1) the intranet zone and saying these sites
are my intranet sites that I should then automatically authenticate to within Google,
Chrome, Edge browsers, etc... via the
2) AuthServerAllowList. And within Firefox you would add things to the
3) auth.trusted-uris configuration option.
✔✔Client Connector Intervals (when will ZCC refresh information it has about apps,
profiles, PAC files, and/or policy) - On network change - ✔✔Any time there is a network
change, such as when the device comes out of hibernation and reconnects to Wi-Fi, I
turn Wi-Fi on and off, or I restart the processes. There'll be a full refresh of all of those
objects.
✔✔Client Connector Intervals (when will ZCC refresh information it has about apps,
profiles, PAC files, and/or policy) - Every Two Hours - ✔✔Every two hours Zscaler
Client Connector will check for software updates.
✔✔Client Connector Intervals (when will ZCC refresh information it has about apps,
profiles, PAC files, and/or policy) -Every Hour - ✔✔Every hour Zscaler Client Connector
will connect and download any policy updates for the app profiles and forwarding
profiles. If the PAC files or URLs are changed, it will automatically update every hour as
this counts as a profile change.
✔✔Client Connector Intervals (when will ZCC refresh information it has about apps,
profiles, PAC files, and/or policy) - Every 15 Minutes - ✔✔However every 15 minutes,
Zscaler Client Connector will download the PAC file of the app profiles and the
forwarding profiles in case they have changed.
✔✔Client Connector Intervals (when will ZCC refresh information it has about apps,
profiles, PAC files, and/or policy) - Manually - ✔✔The end user can obviously also
,initiate an update through the administration of Zscaler Client Connector and force a
check for software updates or force a check for policy change.
✔✔What posture checks can be done on BYOD & Corporate devices? - ✔✔1. Device
Security - Anti-Virus, OS Version, Disk Encryption, Firewall
2.Endpoint Protection -use this in policy to provide access to applications. And then
interface with third-party endpoint protection, such as CarbonBlack, CrowdStrike,
SentinelOne, Defender, and the CrowdStrike ZTA score to make policy decisions.
- For example, if Defender tells us the device is compromised, then we can prevent
access to an application.
✔✔What does the Strict Enforcment option do? - ✔✔cloudName and policyToken
options to ensure that the user is automatically triggered to the right cloud and
authentication token.
Basically it makes sure that the user can not access the Internet until they are enrolled.
✔✔What do you need to ensure when deploying app connectors? - ✔✔1. They are
deployed in pairs (minimum)
2. Can route to the internet and internal applications.
3. Meet the minimum VM requirements.
4. Can connect to applications (TCP/UDP) for health checking.
5. Source IPs are registered in Active Directory Sites & Services, as the requests will be
seen as coming from the App Connectors.
✔✔When deploying an app connector the connector group needs what provisioned for
each group? - ✔✔A provisioning key.
Provisioning keys are signed by an intermediate certificate authority and the
intermediate trusted by the root CA. Clients are enrolled against a client intermediate
certificate authority.
Note: Revoking/deleting the intermediates breaks the trust, invalidating the provisioning
keys. THESE PROVISIONING KEYS ARE TO BE TREATED AS IF THEY ARE
CREDENTIALS.
✔✔When provisioning connector groups for app connectors what must they be
associated with? - ✔✔A Server Group.
Note: Dynamic Server Discovery on that server group means that either the 40 group or
the connectors will automatically perform DNS resolution and create synthetic server
associations that advertise those applications. This is the default (recommended)
configuration and, it is not recommended to move away from Dynamic Server Discovery
unless for a very specific reason.
, ✔✔What is an application segment? - ✔✔This is a grouping of applications (which must
be defined within an application segment), those defined FQDNS that make that
application function. A segment group is a grouping of similar applications that you want
to apply policy to.
Example: IF you wanted Sales to be able to access all of these applications. In such a
case, there would be different applications in different segments, possibly in different
locations, but they're grouped together because they should provide the same service,
and a similar set of users should be able to access that segment.
✔✔Describe the flow of an app connector. - ✔✔1. Traffic is identified on the client
system to determine if it's an application needing to be served by ZPA
2. After traffic reaches the Zero Trust Exchange (ZTE), policy evaluation takes place to
determine if the user is allowed to access the requested application
3. If access is allowed as per the configured policy, then the App Connector group that
is closest to the user's location is identified by the ZTE
4. Connection is then brokered, and the user is able to access the application
✔✔What is browser based access? - ✔✔It provides connectivity through a web browser
without the Zscaler Client Connector being installed to HTTP and HTTPS applications.
This core connectivity capability also provides access to Privileged Remote Access
applications such as SSH or RDP.
✔✔What are some browser based access use-cases? - ✔✔1. It provides authenticated
private website access to third parties without managing a DMZ or internet edge
2. It provides access without using a VPN, browser extension, or any client software
3. It delivers the same experience a user would go when connecting directly to an
intranet website
4. It allows websites to reside anywhere—in an on-premises data center or in a public
cloud
5. It can inspect requests/response with App Protection to protect your intranet website
from OWASP Top 10 & custom signatures
✔✔How does browser based access work? - ✔✔1. User types in the URL of internal
web application or the User Portal and is redirected to appropriate IDP for user
authentication.
2. The closest connector to requested app creates inside out TLS 1.2 encrypted tunnel
over port 443.
3. The Zscaler broker stitches together apps to user connection in the broker location
closest
4. to the user, presenting them with either the direct application or the User Portal,
depending on which option the user selected.
5. Real-time, global visibility into all user and app activity
✔✔What is critical when configuring browser based access? - ✔✔1. The client trusts the
server certificate.
SET A+
✔✔These three actions can be pushed out through group policy objects and identified
from your existing PAC file, migrated into the browser configuration, and pushed out
before the migration to Zscaler occurs. - ✔✔1) the intranet zone and saying these sites
are my intranet sites that I should then automatically authenticate to within Google,
Chrome, Edge browsers, etc... via the
2) AuthServerAllowList. And within Firefox you would add things to the
3) auth.trusted-uris configuration option.
✔✔Client Connector Intervals (when will ZCC refresh information it has about apps,
profiles, PAC files, and/or policy) - On network change - ✔✔Any time there is a network
change, such as when the device comes out of hibernation and reconnects to Wi-Fi, I
turn Wi-Fi on and off, or I restart the processes. There'll be a full refresh of all of those
objects.
✔✔Client Connector Intervals (when will ZCC refresh information it has about apps,
profiles, PAC files, and/or policy) - Every Two Hours - ✔✔Every two hours Zscaler
Client Connector will check for software updates.
✔✔Client Connector Intervals (when will ZCC refresh information it has about apps,
profiles, PAC files, and/or policy) -Every Hour - ✔✔Every hour Zscaler Client Connector
will connect and download any policy updates for the app profiles and forwarding
profiles. If the PAC files or URLs are changed, it will automatically update every hour as
this counts as a profile change.
✔✔Client Connector Intervals (when will ZCC refresh information it has about apps,
profiles, PAC files, and/or policy) - Every 15 Minutes - ✔✔However every 15 minutes,
Zscaler Client Connector will download the PAC file of the app profiles and the
forwarding profiles in case they have changed.
✔✔Client Connector Intervals (when will ZCC refresh information it has about apps,
profiles, PAC files, and/or policy) - Manually - ✔✔The end user can obviously also
,initiate an update through the administration of Zscaler Client Connector and force a
check for software updates or force a check for policy change.
✔✔What posture checks can be done on BYOD & Corporate devices? - ✔✔1. Device
Security - Anti-Virus, OS Version, Disk Encryption, Firewall
2.Endpoint Protection -use this in policy to provide access to applications. And then
interface with third-party endpoint protection, such as CarbonBlack, CrowdStrike,
SentinelOne, Defender, and the CrowdStrike ZTA score to make policy decisions.
- For example, if Defender tells us the device is compromised, then we can prevent
access to an application.
✔✔What does the Strict Enforcment option do? - ✔✔cloudName and policyToken
options to ensure that the user is automatically triggered to the right cloud and
authentication token.
Basically it makes sure that the user can not access the Internet until they are enrolled.
✔✔What do you need to ensure when deploying app connectors? - ✔✔1. They are
deployed in pairs (minimum)
2. Can route to the internet and internal applications.
3. Meet the minimum VM requirements.
4. Can connect to applications (TCP/UDP) for health checking.
5. Source IPs are registered in Active Directory Sites & Services, as the requests will be
seen as coming from the App Connectors.
✔✔When deploying an app connector the connector group needs what provisioned for
each group? - ✔✔A provisioning key.
Provisioning keys are signed by an intermediate certificate authority and the
intermediate trusted by the root CA. Clients are enrolled against a client intermediate
certificate authority.
Note: Revoking/deleting the intermediates breaks the trust, invalidating the provisioning
keys. THESE PROVISIONING KEYS ARE TO BE TREATED AS IF THEY ARE
CREDENTIALS.
✔✔When provisioning connector groups for app connectors what must they be
associated with? - ✔✔A Server Group.
Note: Dynamic Server Discovery on that server group means that either the 40 group or
the connectors will automatically perform DNS resolution and create synthetic server
associations that advertise those applications. This is the default (recommended)
configuration and, it is not recommended to move away from Dynamic Server Discovery
unless for a very specific reason.
, ✔✔What is an application segment? - ✔✔This is a grouping of applications (which must
be defined within an application segment), those defined FQDNS that make that
application function. A segment group is a grouping of similar applications that you want
to apply policy to.
Example: IF you wanted Sales to be able to access all of these applications. In such a
case, there would be different applications in different segments, possibly in different
locations, but they're grouped together because they should provide the same service,
and a similar set of users should be able to access that segment.
✔✔Describe the flow of an app connector. - ✔✔1. Traffic is identified on the client
system to determine if it's an application needing to be served by ZPA
2. After traffic reaches the Zero Trust Exchange (ZTE), policy evaluation takes place to
determine if the user is allowed to access the requested application
3. If access is allowed as per the configured policy, then the App Connector group that
is closest to the user's location is identified by the ZTE
4. Connection is then brokered, and the user is able to access the application
✔✔What is browser based access? - ✔✔It provides connectivity through a web browser
without the Zscaler Client Connector being installed to HTTP and HTTPS applications.
This core connectivity capability also provides access to Privileged Remote Access
applications such as SSH or RDP.
✔✔What are some browser based access use-cases? - ✔✔1. It provides authenticated
private website access to third parties without managing a DMZ or internet edge
2. It provides access without using a VPN, browser extension, or any client software
3. It delivers the same experience a user would go when connecting directly to an
intranet website
4. It allows websites to reside anywhere—in an on-premises data center or in a public
cloud
5. It can inspect requests/response with App Protection to protect your intranet website
from OWASP Top 10 & custom signatures
✔✔How does browser based access work? - ✔✔1. User types in the URL of internal
web application or the User Portal and is redirected to appropriate IDP for user
authentication.
2. The closest connector to requested app creates inside out TLS 1.2 encrypted tunnel
over port 443.
3. The Zscaler broker stitches together apps to user connection in the broker location
closest
4. to the user, presenting them with either the direct application or the User Portal,
depending on which option the user selected.
5. Real-time, global visibility into all user and app activity
✔✔What is critical when configuring browser based access? - ✔✔1. The client trusts the
server certificate.
