Zscaler design guidance for GRE connectivity emphasizes three key principles: terminate GRE on border (edge) devices, avoid NAT on GRE source addresses, and scale bandwidth by using multiple tunnels. In Zscaler documentation and engineering training, each GRE tunnel is typically sized for up to about 1 Gbps of throughput. For a 2 Gbps requirement, customers are advised to deploy at least two primary GRE tunnels , with two additional backup tunnels for redundancy and failover.

These tunnels should terminate on border routers that own public IP addresses, ensuring optimal routing and simplifying troubleshooting. Zscaler specifically recommends that the public source IPs used for GRE must not be translated by NAT , because the Zscaler cloud must see the original, registered public IP to associate tunnels with the correct organization and enforce policy. Enabling NAT on GRE traffic can break tunnel establishment and lead to asymmetric or unpredictable routing.

Using internal routers introduces extra hops and complexity and often requires NAT or policy-based routing, which goes against recommended best practices. Similarly, any architecture with NAT enabled on GRE traffic conflicts with Zscaler’s published requirements. Therefore, the ideal and recommended design for 2 Gbps via GRE is two primary and two backup GRE tunnels from border routers with NAT disabled .

Zscaler Private Access (ZPA) uses the Log Streaming Service (LSS) to deliver ZPA logs (such as user activity and connector/authentication logs) to external SIEM and analytics platforms. LSS relies on a ZPA App Connector as the local relay between the ZPA service and the downstream log receiver. If network connectivity between ZPA and the local App Connector is interrupted, log delivery may be temporarily disrupted.

According to Zscaler integration guidance, when connectivity between ZPA and the local App Connectors is restored, LSS can retransmit up to 15 minutes of previously undelivered log data , although this retransmission is not guaranteed in all circumstances. This limited replay window is designed to provide reasonable resilience for short outages without requiring large local storage on the connector.

The 15-minute buffer applies specifically to ZPA log streaming scenarios and is distinct from longer-term log retention in Zscaler’s logging cluster or external SIEM. Options A, C, and D overstate the supported replay duration and do not match Zscaler’s documented behavior. To minimize log gaps beyond this 15-minute window, Zscaler recommends resilient network paths for App Connectors and careful monitoring of connector health so that LSS can operate continuously.

===========

Within the Zscaler Client Connector administration portal, an App Profile defines how the client behaves for a set of users or devices. A key element of any App Profile is the associated Forwarding Profile. The Forwarding Profile tells the Zscaler Client Connector how to handle traffic in different network conditions: for example, whether to send traffic through Z-Tunnel 2.0 to ZIA and/or ZPA, rely on a PAC file, or bypass Zscaler when on trusted networks.

When you create or edit an App Profile, selecting a Forwarding Profile is mandatory because it determines how user traffic will actually reach the Zscaler cloud. Without a Forwarding Profile, the App Profile would not know which forwarding mode to use, and the client would have no consistent instructions on when and how to tunnel or bypass traffic. In practice, customers often define multiple Forwarding Profiles (for example, “ZIA-only,” “ZPA-only,” or “ZIA and ZPA”) and then bind them to different App Profiles for different user groups or device types.

“Bypass,” “authentication,” or “exception” profiles are not separate required profile objects in the ZCC policy model. Any bypass or exception behavior is defined inside the forwarding and app profile logic, not as standalone mandatory profiles. Therefore, a Forwarding Profile is the one element that every ZCC App Profile must include.

===========

The ZIdentity documentation on external identity providers explains that Zscaler supports various third-party IdPs over SAML and OIDC , and then provides specific configuration guides for each provider. For PingOne , Auth0 , and OneLogin , the ZIdentity help explicitly describes configuring each as an OpenID Provider (OP) for ZIdentity, clearly stating that they are used to provide SSO via OpenID Connect (OIDC) .

By contrast, the ZIdentity guides for Microsoft AD FS consistently describe configuring AD FS “as the SAML Identity Provider (IdP) for ZIdentity,” and the examples focus on SAML assertions, claim rules, and certificate bindings—not OIDC flows. In other words, AD FS is supported in a SAML mode with ZIdentity, but it is not listed among the IdPs configured as OpenID Providers for OIDC-based integrations.

The Digital Transformation Engineer identity modules reinforce this differentiation by mapping external IdPs to either OIDC or SAML in the ZIdentity configuration, and the hands-on labs use Azure/Microsoft Entra ID or PingOne for OIDC examples, while AD FS is shown only in SAML scenarios.

Therefore, among the options listed, Microsoft AD FS is the external IdP that is unsupported by OIDC with Zscaler ZIdentity, making option C the correct answer.

===========

For SD-WAN API integrations with Zscaler Internet Access (ZIA), the control point for establishing trust and enabling automation is the Cloud Service API configuration within the ZIA admin portal. As documented in Zscaler’s SD-WAN and Cloud Service API workflow, the ZIA administrator navigates to the Cloud Service API (under Administration) and configures the SD-WAN integration by generating and managing the SD-WAN Partner Key there. This key is then used by the SD-WAN orchestrator or controller to authenticate against Zscaler’s APIs and to automate the creation of locations and tunnels.

The key is not provided by the SD-WAN partner; rather, it is created and controlled by the customer’s ZIA admin, which makes option D incorrect. Locations and tunnels created via the integration remain visible and generally manageable within the ZIA admin interface, so option B is incorrect. While SD-WAN integrations can automate both GRE and IPsec tunnels in many deployments, that behavior depends on the specific SD-WAN vendor and design, so the blanket statement in option A is not the definitive, document-aligned fact being tested.

Zscaler Internet Access (ZIA) supports regional processing requirements through the concept of subclouds . A subcloud is defined as a subset of ZIA Public Service Edges (and optionally Private Service Edges) that operate as full-featured secure internet gateways inspecting all web traffic. ZIA administrators can create a custom pool of data centers (Public Service Edges) that are constrained to a specific geography and then associate locations or tunnels with that subcloud. This ensures that user traffic forwarded to ZIA is only terminated and inspected within that defined regional pool, helping satisfy data-residency and regulatory mandates

By contrast, Zscaler’s default behavior is to use geo-IP and DNS to send traffic to the nearest available Public Service Edge globally, which may violate regional-processing rules (making option D unsuitable i n a compliance-driven scenario) Bypassing ZIA (option A) or deploying local VPNs (option C) would undermine the Zero Trust model and remove ZIA’s inline security controls. Therefore, configuring a subcloud that includes only Public Service Edges in the mandated region is the architecturally correct and exam-aligned method to keep inspection within a specific geography.

===========

Zscaler’s advanced data protection stack includes Exact Data Match (EDM) , Indexed Document Match (IDM) , dictionaries, and predefined DLP engines. Zscaler describes EDM as a technique that “fingerprints” sensitive values—such as PII from structured data sources (databases or spreadsheets)—so the platform can detect and block exact matches to those values while greatly reducing false positives.

With EDM, an on-premises index tool hashes the sensitive fields (for example, names, IDs, or other PII) and then uploads only these hashes— not the readable PII itself —into the Zscaler cloud. Zscaler documentation emphasizes that only hashed fingerprints are sent, allowing organizations to protect internal data “without having to transfer that data to the cloud” in plain form. This directly addresses the requirement to block exfiltration of internal PII without fear of compromise .

Dictionaries and core DLP engines focus on pattern- or keyword-based detection (such as generic PII patterns) rather than matching exact records from an internal dataset. IDM, on the other hand, fingerprints whole documents or forms (for example, templates or high-value documents) rather than row-level PII records. Therefore, for uploading organization-specific PII in a privacy-preserving, hashed form to enable precise blocking, EDM is the correct technology.

===========

Top of Form

Bottom of Form

In Zscaler, the Endpoint DLP report is specifically designed to give security teams visibility into how end users interact with sensitive data on their endpoints (laptops, desktops, etc.). This report aggregates activity such as copying, saving, printing, uploading, or otherwise handling sensitive content that is detected and classified by Zscaler Endpoint DLP. It focuses on data risk rather than just malware or traffic volumes, so it shows which files, users, and devices are involved in policy matches, along with the context of each event.

Unlike a generic malware or data usage report, the Endpoint DLP report is tightly aligned with DLP policies and data classifications you configure (such as PII, financial data, source code, or custom patterns). This allows you to quickly see which policies are triggering on endpoints, which channels or applications are most frequently involved, and where to fine-tune rules or add additional controls. Because it is endpoint-focused, it covers scenarios even when users are off the corporate network, giving a unified view across inline and endpoint DLP enforcement. For exam purposes, this is why Endpoint DLP report is the correct answer.

===========