ZDTA ACTUAL FINALS ANSWERS AND QUESTIONS
SET A+
✔✔How does SSL inspection work within ZPA? - ✔✔Simple Answer: ZPA it is in
essence a reverse proxy, becoming the web server that the user is connecting to.
Long Answer:
1. There's a Client Hello towards ZPA and
2. then there's a connection from the App Connector to the application, where the real
service certificate is provided to the App Connector.
3. The App Connector or the ZPA Service Edge provides a real service certificate back
to the client.
4. The real service certificate may be the same one from the application, or it may be a
certificate that was specifically uploaded to the ZPA platform for those websites that we
are proxying through it.
✔✔What options do you have available with Zscaler's Granular Policy Framework? -
✔✔1. user
2. group
3. department
4. the category
5. the cloud application
6. anything around the FQDN
7. the IP address
8. even device types
✔✔How does the Zero Trust Exchange decide how to authenticate a user? - ✔✔1.
Client Connector - Was the user prompted to enter a Username?
2. The Domain (after the @) maps to the Identity Provider, and user is redirected to the
Identity Provider to authenticate
3. Client Connector - Was the client installed with a -userDomain option The Domain
maps to the Identity Provider
4. Browser-Based Access - Multiple Identity Providers configured? The user is
prompted for a username/email. The Domain (after the @) maps to the Identity
Provider, and user is redirected to the Identity Provider to authenticate
,5. Browser-Based Access - Single Identity Provider configured? The user will
automatically be redirected to the Identity Provider
✔✔True or False Zscaler does not support mutliple IdPs. - ✔✔False
Most organizations will have a single Identity Provider During Mergers & Acquisitions, or
Cloud Migration, multiple Identity Providers may be necessary thus multiple IdPs is
supported.
✔✔Define logging architecture. - ✔✔The logging architecture is for when the user
makes a transaction through the Zero Trust Exchange, it passes logs through a log
router which decides where those logs will be stored.
✔✔What are some ZDX features / use cases. - ✔✔● Being the first to know when the
user experience degrades
● Rapidly resolving performance issues
● Ensuring application performance
● Gaining comprehensive network insights
● Getting detailed device insights
✔✔What is the flow for ZDX once when an application is configured? - ✔✔1. is sent to
the client
2. which then probes the application at 5 minute intervals.
3. That data is then sent to the Telemetry and Policy Gateway (TPG)
4. which is then sent to the Analytics Engine
5. where it feeds into the ZDX Dashboard.
Note: Applications can come as predefined or custom.
✔✔What type of metrics can web probes can be used to collect? - ✔✔● Page Fetch
Time - network fetch time for the specified URL
● DNS Time - time it took to resolve the DNS name
● Server Response Time - time to the first byte
● Availability - is the service available, yes or no
✔✔What can cloud path probes be used for? What Metrics can they gather? - ✔✔They
can discover the network elements of the application, basically what are the network
hops the user is taking on the way to the application.
Metrics collected include:
● Hop Count
● Packet Loss - for each hop
● Latency Information
✔✔What protocols are included in cloud path probes? - ✔✔● Adaptive - the best
protocol for each leg in the cloud is selected by an auto-discovery process
, ● ICMP - default value, processed by router CPU
● TCP - processed by router ASIC, immune to rate limiting
● UDP - some routers only respond to UDP packets, RFC recommended port of 33434
✔✔Top troubleshooting administrator experiences with ZDX. - ✔✔1. Deep Tracing -
Collects more information about the user's device. Instead of 5-minute intervals (the
default), administrators can run an on-demand deep trace on the user's machine,
targeting a specific application.
2. Y-Engine - Helps you get to the root cause of a problem quickly, automating your root
causes analysis for the impacted ZDX Score
3. UCaas Monitoring - Monitoring and looking at call quality for users (Zoom, Teams)
over time, with the ability to focus on specific meetings (participants, locations,
devices...
4. Software & Device Inventory - Provides the ability to drill down all the way on a
specific user or device to learn what software is present, at what level, to help correlate
if a specific software or devices might be impacted.
✔✔What are the challenges with legacy firewall solutions? - ✔✔The challenge is that
legacy firewall appliances are zone-based architectures.
- They establish barriers between trusted internal and untrusted external networks,
where user policies and criteria are made available.
This poses three main risks for organizations around security, performance, and cost
and complexity
✔✔What are the three most important use cases cloud generation firewalls enable
enterprises? - ✔✔1. Work from anywhere - use case is being very adaptive and
consistent when it comes to accessing applications - no matter where you are -
especially post-COVID, with hybrid work becoming the common norm for all enterprises.
2. More secure connections - customers to migrate from their hub-and-spoke
architecture to more direct-to-internet architecture for making their most important SaaS
applications like M365, Salesforce, and other key applications more secure
3. Secure end-users accessing applications over the internet. - Optimizing and securing
DNS acts as a first line of defense for many enterprises to prevent half of the threats
right at the DNS level itself
✔✔What is the purpose of URL filtering? - ✔✔It is the first line of defense that an
organization needs to leverage in order to provide effective and efficient access security
control for users.
This allows those enterprises to:
SET A+
✔✔How does SSL inspection work within ZPA? - ✔✔Simple Answer: ZPA it is in
essence a reverse proxy, becoming the web server that the user is connecting to.
Long Answer:
1. There's a Client Hello towards ZPA and
2. then there's a connection from the App Connector to the application, where the real
service certificate is provided to the App Connector.
3. The App Connector or the ZPA Service Edge provides a real service certificate back
to the client.
4. The real service certificate may be the same one from the application, or it may be a
certificate that was specifically uploaded to the ZPA platform for those websites that we
are proxying through it.
✔✔What options do you have available with Zscaler's Granular Policy Framework? -
✔✔1. user
2. group
3. department
4. the category
5. the cloud application
6. anything around the FQDN
7. the IP address
8. even device types
✔✔How does the Zero Trust Exchange decide how to authenticate a user? - ✔✔1.
Client Connector - Was the user prompted to enter a Username?
2. The Domain (after the @) maps to the Identity Provider, and user is redirected to the
Identity Provider to authenticate
3. Client Connector - Was the client installed with a -userDomain option The Domain
maps to the Identity Provider
4. Browser-Based Access - Multiple Identity Providers configured? The user is
prompted for a username/email. The Domain (after the @) maps to the Identity
Provider, and user is redirected to the Identity Provider to authenticate
,5. Browser-Based Access - Single Identity Provider configured? The user will
automatically be redirected to the Identity Provider
✔✔True or False Zscaler does not support mutliple IdPs. - ✔✔False
Most organizations will have a single Identity Provider During Mergers & Acquisitions, or
Cloud Migration, multiple Identity Providers may be necessary thus multiple IdPs is
supported.
✔✔Define logging architecture. - ✔✔The logging architecture is for when the user
makes a transaction through the Zero Trust Exchange, it passes logs through a log
router which decides where those logs will be stored.
✔✔What are some ZDX features / use cases. - ✔✔● Being the first to know when the
user experience degrades
● Rapidly resolving performance issues
● Ensuring application performance
● Gaining comprehensive network insights
● Getting detailed device insights
✔✔What is the flow for ZDX once when an application is configured? - ✔✔1. is sent to
the client
2. which then probes the application at 5 minute intervals.
3. That data is then sent to the Telemetry and Policy Gateway (TPG)
4. which is then sent to the Analytics Engine
5. where it feeds into the ZDX Dashboard.
Note: Applications can come as predefined or custom.
✔✔What type of metrics can web probes can be used to collect? - ✔✔● Page Fetch
Time - network fetch time for the specified URL
● DNS Time - time it took to resolve the DNS name
● Server Response Time - time to the first byte
● Availability - is the service available, yes or no
✔✔What can cloud path probes be used for? What Metrics can they gather? - ✔✔They
can discover the network elements of the application, basically what are the network
hops the user is taking on the way to the application.
Metrics collected include:
● Hop Count
● Packet Loss - for each hop
● Latency Information
✔✔What protocols are included in cloud path probes? - ✔✔● Adaptive - the best
protocol for each leg in the cloud is selected by an auto-discovery process
, ● ICMP - default value, processed by router CPU
● TCP - processed by router ASIC, immune to rate limiting
● UDP - some routers only respond to UDP packets, RFC recommended port of 33434
✔✔Top troubleshooting administrator experiences with ZDX. - ✔✔1. Deep Tracing -
Collects more information about the user's device. Instead of 5-minute intervals (the
default), administrators can run an on-demand deep trace on the user's machine,
targeting a specific application.
2. Y-Engine - Helps you get to the root cause of a problem quickly, automating your root
causes analysis for the impacted ZDX Score
3. UCaas Monitoring - Monitoring and looking at call quality for users (Zoom, Teams)
over time, with the ability to focus on specific meetings (participants, locations,
devices...
4. Software & Device Inventory - Provides the ability to drill down all the way on a
specific user or device to learn what software is present, at what level, to help correlate
if a specific software or devices might be impacted.
✔✔What are the challenges with legacy firewall solutions? - ✔✔The challenge is that
legacy firewall appliances are zone-based architectures.
- They establish barriers between trusted internal and untrusted external networks,
where user policies and criteria are made available.
This poses three main risks for organizations around security, performance, and cost
and complexity
✔✔What are the three most important use cases cloud generation firewalls enable
enterprises? - ✔✔1. Work from anywhere - use case is being very adaptive and
consistent when it comes to accessing applications - no matter where you are -
especially post-COVID, with hybrid work becoming the common norm for all enterprises.
2. More secure connections - customers to migrate from their hub-and-spoke
architecture to more direct-to-internet architecture for making their most important SaaS
applications like M365, Salesforce, and other key applications more secure
3. Secure end-users accessing applications over the internet. - Optimizing and securing
DNS acts as a first line of defense for many enterprises to prevent half of the threats
right at the DNS level itself
✔✔What is the purpose of URL filtering? - ✔✔It is the first line of defense that an
organization needs to leverage in order to provide effective and efficient access security
control for users.
This allows those enterprises to:
