[2026年08月22日]ZDTA認定ガイド問題と解答トレーニング
ZDTA認定お試しセット最新ZDTAのPDF問題集
質問 # 36
Zscaler forwards the server SSL/TLS certificate directly to the user's browser session in which situation?
- A. When traffic is exempted in SSL Inspection policy rules.
- B. When traffic contains a known threat signature.
- C. When web traffic is on custom TCP ports.
- D. When user has connected to server in the past.
正解：A
解説：
When a connection matches an SSL Inspection rule set to "bypass," Zscaler performs a passthrough, simply relaying the origin server's certificate intact to the client rather than substituting its own.
質問 # 37
Policy troubleshooting identifies inconsistent enforcement across web and private-application channels for a regulated data type. The inconsistency causes inefficient investigations and intermittent blocking.
Which action would most plausibly improve platform performance under this policy framework?
- A. Align the policies to shared DLP engines and classification labels, with clearly defined precedence to eliminate cross-channel conflicts
- B. Segment enforcement by department so identical data types can be handled differently without policy overlap
- C. Create separate custom rules for each channel to isolate false positives despite using different classification references
- D. Reduce detection scope for private applications and prioritize web controls to minimize cross-channel matches
正解：A
解説：
Option A establishes consistent detection semantics before administrators tune individual enforcement actions. Reusing centrally defined DLP engines and classification labels means that the regulated data type is identified consistently across supported web, SaaS, endpoint, and private-application channels. Explicit precedence then prevents conflicting rules from producing intermittent results. Zscaler describes centralized DLP policy across web, SaaS, public cloud, private applications, endpoints, and BYOD. Its MIP-label documentation explains how Microsoft Information Protection labels can be incorporated into custom DLP dictionaries and engines. Creating bespoke channel definitions increases classification drift and investigation effort. Reducing private-application detection deliberately creates a coverage gap. Departmental fragmentation may be appropriate for different business requirements, but it does not solve inconsistent classification of the same regulated data or establish deterministic handling across channels.
質問 # 38
When configuring an inline Data Loss Prevention policy with content inspection, which of the following are used to detect data, allow or block transactions, and notify your organization's auditor when a user's transaction triggers a DLP rule?
- A. Hosted PAC Files
- B. Index Tool
- C. VPN Credentials
- D. DLP engines
正解：D
解説：
Zscaler DLP separates detection logic from enforcement policy. Dictionaries contain the sensitive-data patterns, keywords, identifiers, regexes, or fingerprinted data that identify protected information. DLP engines use those dictionaries to evaluate content, and DLP rules or policies decide the enforcement action. Option C (DLP engines) is correct because the detection foundation of a DLP engine is the dictionary content it evaluates against traffic or files.
Why the other options are incorrect:
A). Hosted PAC Files: A PAC file tells the client or browser which proxy path to use for matching destinations.
B). Index Tool: Index Tool suggests the hashing/indexing utility itself. In Zscaler DLP terminology, the protected content matching object is the IDM/EDM template or dictionary construct named by the answer.
D). VPN Credentials: VPN credentials authenticate remote network access. They are not a DLP matching method for identifying sensitive documents.
質問 # 39
Malicious File Protection exclusions can be configured for which type of file?
- A. Password-encrypted files
- B. Files sent using the PPTP protocol
- C. Files sent using the RTSP protocol
- D. Files sent using the SCP protocol
正解：A
解説：
Comprehensive and Detailed 100 to 150 words of Explanation From Zscaler Digital Transformation Administrator topics:
Password-encrypted or password-protected files can be addressed through Malware Protection security exceptions, making D correct. Because the service cannot decrypt protected content without the password, it cannot inspect the internal payload in the same manner as an ordinary unencrypted file. ZIA therefore provides policy handling for this condition, allowing administrators to define the appropriate exception or control based on organizational risk. PPTP, SCP, and RTSP are network or application protocols; they are not file conditions used as the Malicious File Protection exclusion described in the question. Administrators should still treat password-protected files cautiously because attackers can use encryption to conceal malicious payloads from content inspection. Zscaler's official security-exception guidance explicitly includes password-protected files, confirming that option D identifies the supported file category.
質問 # 40
While troubleshooting a user's slow application access, can a ZDX administrator see degradations in Wi-Fi signal strength?
- A. No, ZDX only works on hardwired devices.
- B. Yes, a low Wi-Fi signal may be seen in either the results of a Cloud Path Probe or in the device health Wi-Fi signal indicator.
- C. Yes, the Wi-Fi hop latency is shown on a cloud path probe.
- D. Yes. but the current Wi-Fi signal strength is only displayed when doing a deep trace.
正解：B
解説：
ZDX includes endpoint and network-path visibility, including Wi-Fi health indicators. A poor signal can appear in device health telemetry and in Cloud Path Probe context, allowing the administrator to separate a local wireless problem from Zscaler, ISP, or application issues. Option D (Yes, a low Wi-Fi signal may be seen in either the results of a Cloud Path Probe or in the device health Wi-Fi signal indicator) is correct because Wi-Fi signal degradation is visible through ZDX telemetry.
Why the other options are incorrect:
A). Yes, the Wi-Fi hop latency is shown on a cloud path probe: Wi-Fi signal and Wi-Fi hop latency are endpoint/local-network indicators used by ZDX troubleshooting.
B). Yes. but the current Wi-Fi signal strength is only displayed when doing a deep trace: Deep Trace is a detailed diagnostic capture; it is useful, but slower and more manual than Y-Engine root-cause analysis.
C). No, ZDX only works on hardwired devices: ZDX works on supported endpoints running Client Connector, including devices on Wi-Fi. It can expose Wi-Fi signal problems instead of requiring wired-only access.
質問 # 41
When filtering user access to certain web destinations what can be a better option, URL or Cloud Application filtering Policies?
- A. URL filtering policies provide better access control.
- B. Wherever possible URL policies are recommended.
- C. Cloud Application policies provide better access control.
- D. Both provide the same filtering capabilities.
正解：C
解説：
For modern SaaS and web applications, Cloud Application policies usually provide more precise access control than broad URL categories. They can distinguish applications and activities rather than treating the destination as only a URL category. Option A (Cloud Application policies provide better access control) is correct because Cloud Application policies provide deeper application-aware control.
Why the other options are incorrect:
B). URL filtering policies provide better access control: URL Filtering controls web destinations by category, URL, risk, and action such as allow, block, caution, or isolate.
C). Wherever possible URL policies are recommended: URL policies are still useful for category-based web filtering. For SaaS applications, Cloud Application policies provide richer application and activity awareness.
D). Both provide the same filtering capabilities: The two policy types are not equivalent. URL Filtering is destination/category focused, while Cloud App Control understands SaaS apps and actions.
質問 # 42
As technology that exists for a very long period of time, has URL Filtering lost its effectiveness?
- A. URL Filtering is outdated and no longer needed. The rise of HTTPS leads renders URL Filtering ineffective as all traffic is encrypted.
- B. URL Filtering has been replaced by CASB functionality through blocking access to all Internet sites and only allowing a few corporate applications.
- C. In a modern cloud world, access to all Internet sites and cloud applications should be granted by default. URL Filtering is no longer needed.
- D. URL Filter is the most commonly used web filtering technique in the arsenal. It acts as first line of defense.
正解：D
解説：
URL Filtering remains a core first line of web defense even in a cloud and HTTPS-heavy world. It controls access by category, risk, and destination before deeper controls such as DLP, sandboxing, or isolation are applied. TLS inspection improves visibility; it does not make URL Filtering obsolete. Option A (URL Filter is the most commonly used web filtering technique in the arsenal. It acts as first line of defense) is correct because URL Filtering is still a commonly used first-line web-filtering control.
Why the other options are incorrect:
B). In a modern cloud world, access to all Internet sites and cloud applications should be granted by default. URL Filtering is no longer needed: URL Filtering controls web destinations by category, URL, risk, and action such as allow, block, caution, or isolate.
C). URL Filtering has been replaced by CASB functionality through blocking access to all Internet sites and only allowing a few corporate applications: Out-of-band CASB works through SaaS APIs to inspect or remediate content already sitting inside cloud applications.
D). URL Filtering is outdated and no longer needed. The rise of HTTPS leads renders URL Filtering ineffective as all traffic is encrypted: URL Filtering controls web destinations by category, URL, risk, and action such as allow, block, caution, or isolate.
質問 # 43
In which of the following SaaS apps can you protect data at rest via Zscaler's out-of-band CASB solution?
- A. Facebook.
- B. Twitter.
- C. Yahoo Mail
- D. Google Drive.
正解：D
解説：
Out-of-band CASB protects data at rest in supported SaaS repositories by connecting to the provider through APIs. Google Drive is a supported cloud storage/collaboration application where files, sharing links, and sensitive content can be inspected and remediated after storage. Option C (Google Drive) is correct because Google Drive is a SaaS data-at-rest use case.
Why the other options are incorrect:
A). Yahoo Mail: Yahoo Mail is webmail. It can be controlled by ZIA, but the scenario's target is Google Drive cloud storage.
B). Twitter: Twitter/X is a social media service. It is not the cloud file-sharing destination used in the scenario.
D). Facebook: Facebook is a social platform. It does not represent the Google Drive storage action being tested.
質問 # 44
What does Allow Cascading Enabled allow for?
- A. It ensures both Cloud App Control and File Type Control Rules are applied.
- B. It ensures both Cloud App Control and DLP Rules are applied.
- C. It ensures both Cloud App Control and URL Filtering Rules are applied.
- D. It ensures both Cloud App Control and Bandwidth Control Rules are applied.
正解：C
解説：
Allow Cascading is a layered-policy behavior used when Cloud App Control and URL Filtering both need to evaluate the same transaction. Without cascading, an explicit Cloud App Control allow decision can effectively end processing for that transaction. With cascading enabled, the allowed cloud-app transaction is still passed to URL Filtering so URL category, risk, and isolation decisions can also be enforced. Therefore, Option A (It ensures both Cloud App Control and URL Filtering Rules are applied) is correct because it preserves both application-aware control and destination-category filtering in the same access decision.
Why the other options are incorrect:
B). It ensures both Cloud App Control and File Type Control Rules are applied: File Type Control classifies and restricts uploads or downloads by file type, regardless of filename tricks.
C). It ensures both Cloud App Control and Bandwidth Control Rules are applied: Cloud Application Control gives application-aware SaaS policy, including activity and tenant-aware restrictions.
D). It ensures both Cloud App Control and DLP Rules are applied: DLP rules combine detection conditions and policy logic; they are not the content-pattern library itself.
質問 # 45
You've configured the API connection to automatically download Microsoft Information Protection (MIP) labels into ZIA; where will you use these imported labels to protect sensitive data in motion?
- A. Creating a File Type Control Policy.
- B. Creating a custom DLP Dictionary
- C. Creating a custom DLP Policy.
- D. Creating a SaaS Security Posture Control Policy.
正解：C
解説：
Microsoft Information Protection labels imported into ZIA are used as criteria in DLP policy enforcement. A custom DLP policy can inspect data in motion and take actions based on the sensitivity labels attached to documents. Option D (Creating a custom DLP Policy) is correct because MIP labels are consumed in DLP policy logic, not in PAC, file type, or posture policies.
Why the other options are incorrect:
A). Creating a custom DLP Dictionary: A custom DLP Dictionary defines match patterns. Imported MIP labels are used in DLP policy conditions/actions, not turned into a dictionary.
B). Creating a SaaS Security Posture Control Policy: SSPM checks SaaS tenant configuration, risky settings, and compliance posture.
C). Creating a File Type Control Policy: File Type Control classifies and restricts uploads or downloads by file type, regardless of filename tricks.
質問 # 46
The security exceptions allow list for Advanced Threat Protection apply to which of the following Policies?
- A. IPS Control
- B. URL Filtering
- C. File Type Control
- D. Sandbox
正解：D
解説：
Security exception allow lists in Advanced Threat Protection are used with sandbox handling to exempt or control specific traffic from sandbox analysis behavior. They are not URL-filter, file-type, or IPS policy definitions themselves. Option A (Sandbox) is correct because the exception list applies to Sandbox policy behavior.
Why the other options are incorrect:
B). URL Filtering: URL Filtering controls web destinations by category, URL, risk, and action such as allow, block, caution, or isolate.
C). File Type Control: File Type Control classifies and restricts uploads or downloads by file type, regardless of filename tricks.
D). IPS Control: IPS inspects traffic inline for exploit signatures and attack patterns, then blocks or resets offending sessions.
質問 # 47
A firewall policy set evaluates rules from top to bottom and stops at the first match. Rule 1 allows Marketing users outbound TCP 80/443 to any destination. Rule 2 blocks the Anonymizers network-application category globally. Rule 3 blocks all traffic to 203.0.113.0/24.
What outcome and risk are most likely when a Marketing user accesses an anonymizer over HTTPS?
- A. Traffic matches the Marketing allow at Rule 1, the global anonymizer block is not evaluated, and the user gains access to anonymizers, increasing exposure
- B. Traffic is inspected by IPS before Firewall Filtering and is dropped preemptively, reducing the effect of rule order but causing false positives
- C. Traffic is deferred to application categorization first and is blocked at Rule 2, with the user denied but with ambiguous logging
- D. Traffic collides with the destination block at Rule 3 because of subnet inference, resulting in intermittent denial and noisy alerts
正解：A
解説：
Rule 1 can match immediately on the user, protocol, and destination port, so its Allow action terminates evaluation before the anonymizer or subnet blocks are considered. Zscaler's network-application guidance distinguishes application-aware rules from rules capable of a first-packet match, while its recommended Firewall Control Policy emphasizes granular higher-order controls above broad allowances. The result is predictable shadowing: Marketing receives unrestricted HTTPS access, including anonymizers, and gains an evasion path that can conceal malicious activity or data transfer. The global application rule does not automatically override an earlier match, and IPS does not replace the Firewall Filtering decision described.
Rule 3 applies only when the destination belongs to the specified subnet; no such fact is given. The policy should place required global blocks before broad departmental allows or narrow the allow's destination and application criteria.
質問 # 48
How do Access Policies relate to the Application Segments and Application Segment Groups?
- A. When a condition is met, an Access Policy can allow access to Application Segments and block access to Application Segment Groups.
- B. When a condition is met. an Access Policy can either allow or block access to Application Segments and Application Segment Groups.
- C. When a condition is met, an Access Policy can either allow or block access to Application Segments OR Application Segment Groups.
- D. When a condition is met, an Access Policy can allow access to Application Segments Groups and block access to Application Segment.
正解：B
解説：
Access Policies apply the same allow-or-block decision to both individual Application Segments and to Application Segment Groups when their rule conditions are met.
質問 # 49
A regional office reports persistent throttling of a critical SaaS application during business hours. The Bandwidth Control dashboard shows the application assigned to a class with a narrow maximum, while rule- hit counts indicate that non-critical streaming traffic is receiving excessive bandwidth.
Which action should the network team take to improve performance?
- A. Stream firewall logs to the SIEM and defer policy updates until multi-source correlation identifies external bottlenecks
- B. Add a parallel rule for the critical application in the same class to increase match frequency despite the existing caps
- C. Broaden minimum bandwidth globally, accepting reduced headroom for all locations to offset localized congestion
- D. Refactor the bandwidth-class definitions and rule order to increase the critical application's allocation and restrict non-critical streaming, then validate the change in Firewall Insights
正解：D
解説：
Option D directly corrects both configuration problems shown by the evidence: the critical SaaS application has an overly restrictive class maximum, and lower-priority streaming traffic has excessive allocation. ZIA Bandwidth Control uses bandwidth classes and policy rules to allocate or limit traffic, so the administrator should revise the relevant class values and ensure that rule order produces the intended match. Zscaler's Bandwidth Control overview and bandwidth-rule configuration guidance support managing allocations through classes and ordered rules. Firewall Insights can then confirm application usage and policy effects. A duplicate rule cannot bypass the existing class cap. A global increase wastes capacity and may worsen contention elsewhere. Sending logs to a SIEM may aid investigation, but delaying an evidence-supported correction leaves the known throttling condition unresolved.
質問 # 50
What ports and protocols are forwarded to the Zero Trust Exchange when Zscaler Client Connector is using Tunnel 2.0?
- A. All TCP and UDP ports as well as ICMP traffic.
- B. Any HTTP/HTTPS traffic as well as DNS.
- C. All Web ports as well as FTP and SSH.
- D. TCP ports 80, 443 and 8080 only.
正解：A
解説：
Z-Tunnel 2.0 extends forwarding beyond web proxy traffic by securing all IP unicast traffic through DTLS
/TLS tunnels to the Zero Trust Exchange. This enables Cloud Firewall and other controls to inspect all TCP and UDP ports, and ICMP where supported, rather than only browser HTTP/HTTPS flows. Option C (All TCP and UDP ports as well as ICMP traffic) is correct because Tunnel 2.0 is the all-ports-and-protocols forwarding model for Client Connector.
Why the other options are incorrect:
A). TCP ports 80, 443 and 8080 only: Ports 80, 443, and 8080 describe common web proxy traffic. Tunnel
2.0 forwards broader IP traffic, including TCP, UDP, and ICMP.
B). Any HTTP/HTTPS traffic as well as DNS: DNS resolves names to IP addresses; it is a support service, not an access protocol or scoring engine by itself.
D). All Web ports as well as FTP and SSH: RDP, SSH, and VNC are privileged remote access protocols for desktop, shell, and graphical administration.
質問 # 51
What is one of the four steps of a cyber attack?
- A. Find Cash Safe
- B. Find Least Secure Office Building
- C. Find Email Addresses
- D. Find Attack Surface
正解：D
解説：
One of the four essential steps of a cyber attack is tofind the attack surface. This step involves identifying vulnerabilities, entry points, and targets within an organization's network or systems that can be exploited by attackers.
The study guide outlines this as a critical phase in the cyber kill chain, where attackers map out potential avenues for compromise.
質問 # 52
Which Platform Service enables visibility into the headers and payload of encrypted transactions?
- A. Reporting and Logging
- B. TLS Decryption
- C. Policy Framework
- D. Device Posture
正解：B
解説：
The TLS Decryption platform service intercepts and decrypts SSL/TLS sessions, granting Zscaler access to both headers and payloads of encrypted traffic for inspection and policy enforcement.
質問 # 53
Does the Access Control suite include features that prevent lateral movement?
- A. Yes. The Cloud Firewall will detect network segments and provide conditional access.
- B. Yes. Controls for segmentation and conditional access are part of the Access Control Services.
- C. No. Access Control Services will only control access to the Internet and cloud applications.
- D. No. The endpoint firewall will detect network segments and steer access.
正解：B
解説：
Yes, theAccess Control suite includes controls for segmentation and conditional access, which are designed to prevent lateral movement within networks. These features allow organizations to restrict access between different segments and enforce policies that limit the spread of threats or unauthorized access within internal environments.
質問 # 54
A platform team deploys Bandwidth Control and firewall policy changes through an API. After a large rollout, users report sporadic application slowdowns, yet the monitoring team finds gaps in telemetry for the same time windows.
Which action best prevents these performance issues from persisting and going undetected in similar rollouts?
- A. Increase API client-token lifetimes to reduce HTTP 401 errors and stabilize automation during policy pushes
- B. Aggregate logs monthly and perform retrospective correlation to avoid noisy short-term fluctuations in metrics
- C. Restrict automation runs to weekly windows to minimize configuration changes that may obscure trend lines
- D. Add an implementation step that validates monitoring subscriptions and exports ZDX and Firewall Insights baselines before applying policy changes through APIs
正解：D
解説：
Option A adds the missing observability control before a high-impact automated change. Validating monitoring subscriptions helps ensure that telemetry will be collected during the rollout, while exporting pre- change ZDX and Firewall Insights baselines creates a reference for detecting latency, loss, application, and policy-behavior regressions. Zscaler's ZDX Reference Architecture recommends controlled deployment and validation, and the Internet and SaaS performance troubleshooting runbook uses ZDX and Firewall Insights as complementary evidence sources. Monthly aggregation is too delayed for rollout protection. Longer API- token lifetimes address authentication continuity, not missing monitoring data or application performance.
Running automation weekly merely reduces deployment frequency; it does not prove telemetry coverage or provide a reliable before-and-after comparison for each policy change.
質問 # 55
When correlating indicators of privilege escalation with administrator behavior, which log type provides the most direct visibility into role changes and entitlement modifications for administrative accounts?
- A. Web Insights transaction logs focusing on URL categories and inline policy actions
- B. Firewall Insights reports centered on rule hits and bandwidth consumption at egress points
- C. ZIdentity Administrator Audit Log filtered for entitlement updates and role assignments
- D. Endpoint DLP telemetry summarizing sensitive-data handling and removable-media events
正解：C
解説：
Answer B is correct. Privilege escalation investigation requires evidence of administrative control-plane actions, especially who changed a role or entitlement, what was changed, and when it occurred. The ZIdentity Administrator Audit Log is the relevant source because Authentication Service centrally manages administrative roles and entitlements across Zscaler services. Filtering that audit trail for role assignments, entitlement updates, and the suspected administrator provides the most direct correlation. Firewall Insights and Web Insights describe data-plane traffic and policy outcomes, while Endpoint DLP telemetry concerns sensitive-data activity; none is the authoritative record of an administrative role change. If the investigation or retention window extends beyond the portal's availability, stream the audit data to the organization's logging platform. See Zscaler's admin roles and permissions and Authentication Service log-streaming guidance.
質問 # 56
......
Zscaler ZDTA 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
| トピック 6 |
|
| トピック 7 |
|
ベストZscaler ZDTA学習ガイドと問題集は2026：https://jp.fast2test.com/ZDTA-premium-file.html
トップクラスZscaler ZDTA試験最先端学習ガイド！練習問題バージョン：https://drive.google.com/open?id=1JEFUAPmFRswIvriOrgp97tmCDpzjGahm