Zscaler ZDTA Exam Questions
Zscaler Digital Transformation Administrator (Page 3 )

Updated On: 17-May-2026

Zscaler Data Protection supports custom dictionaries.

What actions can administrators take with these dictionaries to protect data in motion?

  1. Define specific keywords, phrases, or patterns relevant to their organization's sensitive data policy.
  2. Define specific governance and regulations relevant to their organization's sensitive data policy.
  3. Define specific SaaS tenant relevant to their organization's sensitive data policy.
  4. Define specific file types relevant to their organization's sensitive data policy.

Answer(s): A

Explanation:

Administrators can build custom dictionaries by defining the exact keywords, phrases, or regex patterns that
reflect their organization's sensitive data. Zscaler then uses these dictionaries in its data-in-motion policies to accurately identify and block or protect matching content.



What enables zero trust to be properly implemented and enforced between an originator and the destination application?

  1. Trusted network criteria designate the locations of originators which can be trusted.
  2. Access is granted without sharing the network between the originator and the destination application.
  3. Cloud firewall policies ensure that only authenticated users are allowed access to destination applications.
  4. Connectivity between the originator and the destination application is over IPSec tunnels.

Answer(s): B

Explanation:

Zero Trust is achieved by granting users application-level access without ever placing them on the same network as the destination, ensuring users can reach only the specific app and never the underlying network.



If you're migrating from an on-premises proxy, you will already have a proxy setting configured within the browser or within the system. With Tunnel Mode, the best practice is to configure what type of proxy configuration?

  1. Execute a GPO update to retrieve the proxy settings from AD.
  2. Enforce no Proxy Configuration.
  3. Use Web Proxy Auto Discovery (WPAD) to auto-configure the proxy.
  4. Use an automatic configuration script (forwarding PAC file).

Answer(s): B

Explanation:

In Tunnel Mode the Client Connector captures and forwards traffic itself, so you should enforce no proxy configuration on the endpoint, letting the Connector handle all proxying and ensuring there's no conflict with existing browser or system proxy settings.



While troubleshooting a user's slow application access, can a ZDX administrator see degradations in Wi-Fi signal strength?

  1. Yes, the Wi-Fi hop latency is shown on a cloud path probe.
  2. Yes, but the current Wi-Fi signal strength is only displayed when doing a deep trace.
  3. No, ZDX only works on hardwired devices.
  4. Yes, a low Wi-Fi signal may be seen in either the results of a Cloud Path Probe or in the device health Wi- Fi signal indicator.

Answer(s): D

Explanation:

ZDX collects Wi-Fi signal strength as part of its Endpoint Monitoring metrics and also displays it in Cloud Path Probe results, so you can spot low signal quality either in the device health Wi-Fi indicator or when examining the Cloud Path visualization.



Which types of Botnet Protection are supplied by Advanced Threat Protection?

  1. Connections to known C&C servers, Detection of phishing sites, Access to spam sites
  2. Malicious file downloads, Command traffic (sending / receiving), Data exfiltration
  3. Connections to known C&C servers, Command traffic (sending / receiving), Unknown C&C using AI ML
  4. Vulnerabilities in web server applications, Unknown C&C using AI ML, vulnerable ActiveX controls

Answer(s): C

Explanation:

Advanced Threat Protection's Botnet Protection covers traffic to known command-and-control servers, inspects both outbound and inbound command traffic, and leverages AI/ML to identify previously unknown C&C infrastructures.



Does the Access Control suite include features that prevent lateral movement?

  1. Yes. The Cloud Firewall will detect network segments and provide conditional access.
  2. No. The endpoint firewall will detect network segments and steer access.
  3. Yes. Controls for segmentation and conditional access are part of the Access Control Services.
  4. No. Access Control Services will only control access to the Internet and cloud applications.

Answer(s): C

Explanation:

The Access Control suite includes micro-segmentation and conditional access controls that restrict east-west traffic within your environment, effectively preventing lateral movement.



From a user perspective, Zscaler Bandwidth Control performs traffic shaping and buffering on what direction(s) of traffic?

  1. Outbound traffic is shaped. Inbound or localhost traffic is unshaped.
  2. Outbound or inbound traffic is shaped. Localhost traffic is unshaped.
  3. Inbound traffic is shaped. Outbound or localhost traffic is unshaped.
  4. Localhost traffic is shaped. Outbound or Inbound traffic is unshaped.

Answer(s): A

Explanation:

Zscaler Bandwidth Control shapes and buffers only the outbound traffic from the user's device, ensuring smooth egress flow, while inbound and localhost traffic remain unshaped.



How does Zscaler Risk360 quantify risk?

  1. A risk score is computed based on the number of remediations needed compared to the industry peer average.
  2. A risk score is computed for each of the four stages of breach.
  3. The number of risk events is totaled by location and combined.
  4. Time to mitigate each identified risk is totaled, averaged, and tracked to show ongoing trends.

Answer(s): B

Explanation:

Zscaler Risk360 computes a distinct risk score for each of the four stages of a breach - External Attack Surface, Prevent Compromise, Lateral Propagation, and Data Loss - providing a granular view of where your organization is most exposed.



Viewing page 3 of 24
Viewing questions 17 - 24 out of 178 questions


ZDTA Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!