ZDX collects Wi‑Fi signal strength as part of its Endpoint Monitoring metrics and also displays it in Cloud Path Probe results, so you can spot low signal quality either in the device health Wi‑Fi indicator or when examining the Cloud Path visualization.

Zscaler’s short‑lived intermediate CA certificates on the ZIA Service Edges are valid for 14 days and are automatically rotated every 7 days, minimizing the window of exposure even if a private key is compromised.

The forwarding mechanism called ZTunnel with Local Proxy creates a loopback address on the machine to forward traffic to the Zscaler cloud. This local proxy intercepts client traffic on the loopback interface and securely forwards it through the Zscaler cloud, providing flexibility and control over traffic forwarding.

A “Patient 0” alert fires when the first instance of a previously unknown file slips through (under an “Allow and Scan” first‑time action) and is later classified as malicious by the sandbox, identifying that initial download as the zero‑day event.

A Watering Hole Attack targets users by compromising a website or service that is commonly visited by the intended victims. The attacker injects malicious content such as malicious JavaScript or malware into the website, so when the user visits the site, their system gets infected. This attack relies on the trust users have in popular or legitimate websites and exploits it by turning those sites into infection vectors.

Pre-existing Compromise refers to attacks where the target environment is already compromised before the attack is recognized, but it does not specifically describe malicious content injected into popular websites. Phishing Attack involves deceiving users to click malicious links or reveal credentials, not compromising websites directly. Exploit Kits are automated tools that scan for vulnerabilities and deliver exploits but are not characterized by the use of commonly used websites hosting malicious scripts.

The study guide clearly explains Watering Hole Attacks as a method where attackers infect trusted websites frequented by target users to deliver malicious payloads.

Trusted Network Detection in Zscaler Client Connector can reference DNS Search Domains, DNS Server IPs, and Hostname Resolution (i.e. a hostname and the IP it resolves to) as criteria for determining a trusted network.

You need at least two App Connectors per data center to ensure high availability and load distribution, so with four data centers the minimum total is eight.