最新のZDTA問題集で試験を準備する

A contractor in the Field_Eng SAML group attempts to access an internal CAD application through ZPA from a branch designated as a Trusted Network. The Access Policy requires Field_Eng membership AND a device-posture profile confirming full-disk encryption and a CrowdStrike ZTA score above 80. The user passes the ZTA score requirement, but Device Posture reports that disk encryption is disabled.
Which enforcement outcome should be expected for this session?

• A. Bypass Access Policy evaluation because the branch is designated as a Trusted Network
• B. Quarantine the traffic through ZIA Cloud Sandbox for risk analysis
• C. Permit restricted access through a more distant App Connector
• D. Deny access to the private application because the device fails the mandatory disk-encryption requirement

For a deployment using both ZIA and ZPA set of services, what is the best authentication solution?

• A. Use forms Authentication in ZIA and SAML in ZPA
• B. Configure Authentication using SAML on both ZIA and ZPA
• C. Use forms Authentication in ZPA and SAML in ZIA
• D. Use forms Authentication for both ZIA and ZPA

A team plans to deploy ZPA App Connectors as virtual machines in two data centers and one AWS VPC.
Which information should be communicated upfront to align network placement and access controls with Zero Trust principles?

• A. The application subnets reachable from connector network interfaces, the requirement for outbound TLS to ZPA Service Edges, and the prohibition of inline TLS interception
• B. The GRE or IPsec tunnel endpoints that will terminate user traffic at the data-center perimeter for centralized inspection
• C. The external NAT addresses to advertise for inbound reachability and the BGP communities to tag for internet-facing routes
• D. The reverse-proxy access control lists that will accept client-initiated TLS from the internet and the static public IP addresses required for allowlists

What Malware Protection setting can be selected when setting up a Malware Policy?

• A. Bypass
• B. Block
• C. Isolate
• D. Do Not Decrypt

An administrator must apply file-type controls to a subset of users while ensuring evasion-resistant detection.
Which configuration most directly maps a file-type policy to a user group and role-based security requirements?

• A. Create a URL Filtering rule scoped to the department and reference a custom URL category that lists file extensions for the restricted formats
• B. Define a global File Type Control rule that blocks risky formats and rely on identity-based reporting to address group-level differences later
• C. Create a File Type Control rule using magic-byte, MIME-type, and file-extension checks; scope it to the target SCIM group and device posture; and place it above broader catch-all rules
• D. Enable MIME-type validation in a baseline content policy and expect extension mismatches to be handled through application restrictions