ZDX Score is a normalized digital-experience score used to represent how well a user or application is performing. It is expressed on a 1-to-100 scale, making degraded application, network, and endpoint experience easy to compare across users, locations, and time windows. Option A (1-100) is correct because 1-100 is the ZDX scoring range.

Why the other options are incorrect:

B. 1-10: A 1-10 scale is too coarse for ZDX. ZDX uses a 1-100 score so administrators can see more granular experience changes.

C. 1 - 1000: A 1-1000 scale would imply excessive precision that ZDX does not present. The product score is the simpler 1-100 user-experience scale.

D. 0 - 50: A 0-50 range is not the ZDX scale. ZDX scores are represented on a 1-100 scale.

File Type Control reduces exposure by limiting which file categories users can download or upload, especially from risky or untrusted destinations. It is not a monitoring score or administrative RBAC control; it is a content-control policy that directly limits malicious or high-risk file exposure. Option C (File type Controls) is correct because File Type Control can block dangerous content classes before they reach the endpoint.

Why the other options are incorrect:

A. Role Based Access control (RBAC): RBAC limits administrator privileges by role and scope; it does not inspect user web content or files.

B. Bandwidth Controls: Bandwidth Control shapes outbound traffic to manage congestion and prioritize business use.

D. Zscaler Digital Experience: ZDX monitors experience and helps troubleshoot performance. It does not limit malicious file/content exposure through policy enforcement.

Cloud Browser Isolation protects users by rendering risky web content in a remote browser environment instead of on the endpoint. URL Filtering can use Isolate as an action, so users may still access selected untrusted sites while scripts, active content, and browser-exploit risk remain separated from the device. Option D (Deception) is correct because isolation is an enforceable URL Filtering action, not a separate manual workaround.

Why the other options are incorrect:

A. SandBox: Cloud Sandbox detonates and observes suspicious files to identify unknown or advanced malware behavior.

B. SSL Decryption Bypass: SSL/TLS bypass tells the proxy to pass encrypted traffic without decrypting it for content inspection.

C. Browser Isolation: Browser Isolation renders web content remotely so active content never executes directly on the endpoint.

Comprehensive and Detailed 100 to 150 words of Explanation From Zscaler Digital Transformation Administrator topics:

The hosted PAC file is assigned through Traffic Steering in a Zscaler Client Connector App Profile, making A correct. App Profile rules can be scoped to particular users or groups and contain the traffic-steering configuration applied to those endpoints. The administrator can reference the relevant hosted or custom PAC URL so Client Connector retrieves the file and uses its logic for forwarding and bypass decisions. A Forwarding Profile defines how Client Connector treats traffic in different network environments, but the user-specific App Profile provides the applicable assignment and traffic-steering settings. Global Settings do not provide the per-user hosted PAC association described in the question. Zscaler’s App Profile configuration documentation places user traffic options within Traffic Steering and supports assigning profiles based on user and group criteria.

================

Comprehensive and Detailed 100 to 150 words of Explanation From Zscaler Digital Transformation Administrator topics:

OneAPI is Zscaler’s unified, external-facing API gateway and is therefore the correct choice. It provides a common access layer for API resources across supported Zscaler services, including Zscaler Client Connector. An application or service first obtains an access token through Zscaler Authentication Service, which uses ZIdentity, and then presents that token when requesting resources exposed through the OneAPI gateway. ZIdentity participates in identity verification and token issuance, but it is not the gateway named in the question. The ZPA API is a product API, not the unified external gateway, and Postman is only an API development and testing client. Zscaler describes API resources as endpoints made available through the OneAPI gateway, confirming D.

================

Workflow Automation is used to notify users or teams when a DLP-related workflow needs attention. For end-user notification, enterprise collaboration tools such as Microsoft Teams and Slack are practical because they keep the message inside a controlled business channel. Option A (Notifications in MS Teams / Slack) is correct because Teams and Slack notifications are the supported user-notification path in this scenario.

Why the other options are incorrect:

B. SMS text message: SMS is a generic notification channel. Zscaler Workflow Automation for this use case sends collaboration notifications through tools like Teams or Slack.

C. Automated phone call: Automated phone calls are not the normal DLP workflow-notification method in this Zscaler scenario. The supported peer-collaboration channels are Teams and Slack.

D. Twitter post with custom hashtag: A Twitter/X post would be public and inappropriate for a DLP event. Zscaler uses controlled enterprise notification channels, not social posting.

Option D makes the group eligible to consume the required Zscaler service. Authentication Service service entitlements assign users or user groups to subscribed services such as Internet & SaaS, Private Access, or Digital Experience. After the Contractor ZPA Users group receives the Private Access entitlement, ZPA Access Policy can determine which specific private applications its members may access. Zscaler’s entitlement-management documentation explicitly states that service entitlements assign Authentication Service users and groups to Zscaler services. The entitlement-assignment guide includes Private Access as an assignable service. Creating duplicate local users undermines identity synchronization. Administrator session lifetime controls administrative authentication, not contractor service eligibility. Device posture can further restrict an entitled user’s access, but it cannot replace the underlying ZPA service entitlement that permits the group to use Private Access.

================

Answer B is correct. Zscaler’s official TLS/SSL Inspection reference architecture states that the ZIA Service Edge intermediate CA is used for seven days and remains valid for fourteen days. In other words, it has a 14-day expiry with a 7-day rotation. The overlap lets a newly issued intermediate become active while the previous certificate is still valid, supporting continuity across service edges. ZIA uses this short-lived intermediate to sign on-demand certificates presented to endpoints during SSL inspection. Its private key is retained in the Zscaler CA database and Service Edge memory and is not written to disk at the edge. Therefore, 7/0, 30/7, and 21/14 do not match the documented lifecycle. See Zscaler’s TLS/SSL Inspection reference architecture.

Answer C is correct. A ZPA Client Forwarding Policy determines whether Client Connector sends application traffic to Private Access or bypasses ZPA. Zscaler documents that these rules use the most-specific application segment and a top-down, first-match principle. If a matching rule bypasses the internal hostname, the connection follows the direct network path and never reaches the ZPA Access Policy that contains the posture condition. Consequently, the access log can show the destination as reachable without the expected ZPA enforcement. An SSL inspection rule cannot override ZPA authorization, and a true fail-closed connector condition would not deliberately pass the session through. The administrator should inspect the matched forwarding rule, application-segment bypass setting, and trusted-network criteria, then remove or narrow the bypass. See Zscaler’s Client Forwarding Policy overview and bypass settings guidance.

ZDX monitoring uses two major probe types: Web Probes and Cloud Path Probes. Web Probes measure application availability and page-fetch behavior, while Cloud Path Probes show hop-by-hop path quality, latency, packet loss, and network path conditions. Option A (Web Probes and Cloud Path Probes) is correct because those are the supported ZDX probe types.

Why the other options are incorrect:

B. Application Probes and Network Probes: Application Probes and Network Probes are descriptive names, but ZDX uses Web Probes and CloudPath Probes for the tested application/network visibility.

C. Page Speed Probes and Connection Speed Probes: Page Speed and Connection Speed are performance ideas, not the actual ZDX probe names used in the product.

D. SaaS Probes and Router Probes: SaaS and Router Probes sound plausible, but ZDX’s standard probe model is based on web/application probing and CloudPath network probing.