ZDTA Exam Results

ZIA Malware Protection is an inline security control that blocks malicious files or objects detected through signatures, reputation, and threat-intelligence checks. The policy action must stop the malicious transfer rather than simply route, isolate, or change TLS behavior. Option A (Malware protection) is correct because Block is the malware policy action that prevents the identified malicious content from reaching the user.

Why the other options are incorrect:

B. File reputation: File reputation checks whether an object is known good or bad. The question’s answer is about the behavior-analysis control for unknown files.

C. SHA-256 hashing: SHA-256 hashing is a cryptographic integrity/hash function. It does not execute a suspicious file or observe behavior the way Cloud Sandbox does.

D. Site reputation: Site reputation scores web destinations. It does not detonate or analyze the file itself.

SCIM is useful for automated provisioning, group synchronization, and lifecycle management, but it is not mandatory for ZIA authentication. ZIA can authenticate users through SAML and other supported identity methods even if SCIM is not deployed. Option C (No) is correct because SCIM is optional for ZIA, not required.

Why the other options are incorrect:

A. Depends: Depends is too vague for this exam item. The guide’s concept is deterministic: the stated requirement has a specific yes/no behavior.

B. Maybe: Maybe is not an operational setting. Zscaler configuration questions expect the exact supported behavior, not uncertainty.

D. Yes: Yes would mean the feature is required or supported in the stated way. The correct answer says it is not.

Web Insights is the correct source because the event is an HTTP transaction evaluated by ZIA web policy. Its transaction data can identify the requested URL, user, action, URL category, bytes transferred, and policy-related fields needed to determine why the upload was allowed or blocked. Zscaler’s Insights Logs overview identifies Web logs as the view for transactions initiated from devices, while the Web data types and filters reference documents category and matched-rule information. ZDX measures digital experience and network performance, not the web-policy disposition. DNS Insights focuses on name-resolution activity and cannot establish the HTTP upload action. Firewall Insights is appropriate for Cloud Firewall sessions, services, and firewall-rule matches, but Web Insights provides the transaction-level evidence required here.

Cloud Browser Isolation protects users by rendering risky web content in a remote browser environment instead of on the endpoint. URL Filtering can use Isolate as an action, so users may still access selected untrusted sites while scripts, active content, and browser-exploit risk remain separated from the device. Option D (Yes. Isolate is a possible Action for URL Filtering) is correct because isolation is an enforceable URL Filtering action, not a separate manual workaround.

Why the other options are incorrect:

A. No. Cloud Browser Isolation is a separate platform: Browser Isolation renders web content remotely so active content never executes directly on the endpoint.

B. No. Cloud Browser Isolation is only a feature of Advanced Threat Defense: Browser Isolation renders web content remotely so active content never executes directly on the endpoint.

C. Yes. After blocking access to a site, the user can manually switch on isolation: Browser Isolation renders web content remotely so active content never executes directly on the endpoint.