Zscaler ZDTA Exam Dumps

Option D covers cloud-resident content even when the original transaction did not traverse the inline proxy. Zscaler's out-of-band CASB uses SaaS-provider API integrations to scan data at rest with DLP engines, identify sensitive content, inspect sharing exposure, and support remediation of risky external shares. Zscaler's Data at Rest Scanning DLP configuration guide places this capability under Out-of-Band CASB. Its CASB overview explains that API-based scanning discovers sensitive SaaS content and that collaboration management can revoke risky sharing. Browser Isolation affects future interactive sessions but does not inventory existing SaaS data. Endpoint posture confirms device compliance rather than classifying tenant content or permissions. DNS analysis addresses command channels and suspicious resolution, not whether sanctioned SaaS files contain regulated data or are shared externally.

Option A applies least privilege to the east-west workload flow that must remain available. Zscaler explains that microsegmentation uses identity-based, granular policy so each workload communicates only with resources required for its function, while unauthorized communication is blocked. The payroll server should therefore be permitted to reach the database only on TCP 1433, and unrelated servers should have no path to that database. The wiki should also be separated according to its distinct application identity and access requirements. Placing both applications in a broad segment preserves unnecessary reachability and increases the blast radius; IPS signatures do not replace segmentation. A trusted-network condition addresses user context, not server-to-server authorization. Raising a global user-risk threshold likewise does not constrain the compromised payroll workload's lateral movement. Identity-based service policy directly contains the threat while preserving the required database flow.

Legacy firewalls introduce performance risk because they were designed around centralized perimeter enforcement and hardware capacity limits. Cloud and remote-work traffic creates encrypted, high-volume flows that can overwhelm appliance-based inspection and force inefficient backhauling. Option C (Gen AI Insights Logs) is correct because performance degradation is a real business risk of legacy firewall architecture.

Why the other options are incorrect:

A . SaaS Security Logs: SaaS Security logs cover API/CASB activity in SaaS tenants. Prompt visibility for generative AI applications belongs in Gen AI Insights logs.

B . Web Insights Logs: Web Insights logs summarize web traffic activity; Gen AI prompt visibility belongs in Gen AI Insights where enabled.

D . Advanced Firewall Logs: Advanced Firewall logs show firewall sessions and network applications, not Gen AI prompt content.

Option A satisfies the prohibition against installing endpoint agents while retaining application-level security. ZPA Browser Access provides clientless access to private web applications through a supported browser, so the private application is not exposed to the internet and the unmanaged device does not receive network-level access. Cloud Browser Isolation can isolate SaaS sessions and apply controls that protect data without placing active web content directly on the personal endpoint. Zscaler's Browser Access documentation confirms that users can reach web applications without installing Zscaler Client Connector, while its BYOD secure-access guidance describes agentless access and isolation for unmanaged devices. Options B and D require Client Connector, contrary to the stated restriction. Option C provides neither application segmentation nor comparable data protection.

================

Answer B is correct. Privilege escalation investigation requires evidence of administrative control-plane actions, especially who changed a role or entitlement, what was changed, and when it occurred. The ZIdentity Administrator Audit Log is the relevant source because Authentication Service centrally manages administrative roles and entitlements across Zscaler services. Filtering that audit trail for role assignments, entitlement updates, and the suspected administrator provides the most direct correlation. Firewall Insights and Web Insights describe data-plane traffic and policy outcomes, while Endpoint DLP telemetry concerns sensitive-data activity; none is the authoritative record of an administrative role change. If the investigation or retention window extends beyond the portal's availability, stream the audit data to the organization's logging platform. See Zscaler's admin roles and permissions and Authentication Service log-streaming guidance.