ZDTE Exam Dumps : Zscaler Digital Transformation Engineer

The Data Protection section of the Zscaler Digital Transformation study guide explains that, before applying DLP dictionaries, IDM/EDM, or OCR, Zscaler must reliably determine the actual file type being inspected. To prevent simple evasion techniques (for example, renaming an executable to .pdf), Zscaler performs a three-layer file-type inspection.

The documentation states that Zscaler first examines the file’s “magic bytes” (the signature in the file header), then validates the MIME type reported by the content, and finally compares these to the file extension seen in the transaction. This layered approach ensures that if a user tampers with the extension or the declared MIME type, the underlying binary signature will still reveal the true file type, allowing the correct DLP engine and policy to be applied.

Other attributes like encryption status are indeed considered elsewhere in the DLP workflow (for example, to understand if a file can be decrypted or inspected), but the study guide is explicit that the three levels of file-type inspection are Magic Bytes, MIME type, and file extension, matching option B.

Zscaler’s Data Protection platform integrates Optical Character Recognition (OCR) into its inline Data Loss Prevention (DLP) capabilities. OCR enables Zscaler to extract text embedded within images—such as screenshots, scanned documents, or photos of forms—and subject that text to the same DLP inspection engines that normally analyze plain text content.

Once OCR has converted image content into text, Zscaler can apply predefined dictionaries, custom dictionaries, and advanced classifiers to detect sensitive data types, including personally identifiable information (PII) such as national ID numbers, passport numbers, addresses, or other regulated personal data. This is crucial because many data leaks occur via screenshots or scanned documents that traditional, text-only DLP engines would miss.

While OCR could, in theory, detect patterns related to network configurations, software licenses, or financial transactions, Zscaler’s training and exam materials emphasize its use to protect sensitive data in images—especially user-related regulated data such as PII and other compliance-relevant information. Network configurations and software licenses are better addressed through configuration management and IP protection policies, and “financial transactions” describes activities rather than a specific information pattern. Therefore, Personally Identifiable Information (PII) is the best and most exam-accurate answer for the type of sensitive information protected using OCR.

===========

The ZIdentity documentation on external identity providers explains that Zscaler supports various third-party IdPs over SAML and OIDC, and then provides specific configuration guides for each provider. For PingOne, Auth0, and OneLogin, the ZIdentity help explicitly describes configuring each as an OpenID Provider (OP) for ZIdentity, clearly stating that they are used to provide SSO via OpenID Connect (OIDC).

By contrast, the ZIdentity guides for Microsoft AD FS consistently describe configuring AD FS “as the SAML Identity Provider (IdP) for ZIdentity,” and the examples focus on SAML assertions, claim rules, and certificate bindings—not OIDC flows. In other words, AD FS is supported in a SAML mode with ZIdentity, but it is not listed among the IdPs configured as OpenID Providers for OIDC-based integrations.

The Digital Transformation Engineer identity modules reinforce this differentiation by mapping external IdPs to either OIDC or SAML in the ZIdentity configuration, and the hands-on labs use Azure/Microsoft Entra ID or PingOne for OIDC examples, while AD FS is shown only in SAML scenarios.

Therefore, among the options listed, Microsoft AD FS is the external IdP that is unsupported by OIDC with Zscaler ZIdentity, making option C the correct answer.

===========