ZDTA Premium Exam Questions

Identity Threat Detection and Response focuses on identity risk, particularly in directory environments such as Active Directory. To evaluate AD objects, relationships, permissions, and risky identity configura tions, ITDR needs directory-level data rather than raw packet captures or firewall summaries. Option B (Running LDAP queries) is correct because LDAP queries are the standard mechanism for collecting structured AD domain information for identity-risk analysis.

Why the other options are incorrect:

A. Scanning network ports: Port scanning discovers open TCP/UDP services on hosts. ITDR needs AD identity data, so it queries the directory instead of scanning network sockets.

C. Analyzing firewall logs: Firewall logs show network sessions and policy outcomes. They do not expose AD object relationships, permissions, or identity hygiene the way LDAP directory queries do.

D. Packet sniffing: Packet sniffing captures traffic on the wire. ITDR is not passively sniffing packets here; it gathers structured domain information from Active Directory.

Option A applies least privilege to the east-west workload flow that must remain available. Zscaler explains that microsegmentation uses identity-based, granular policy so each workload communicates only with resources required for its function, while unauthorized communication is blocked. The payroll server should therefore be permitted to reach the database only on TCP 1433, and unrelated servers should have no path to that database. The wiki should also be separated according to its distinct application identity and access requirements. Placing both applications in a broad segment preserves unnecessary reachability and increases the blast radius; IPS signatures do not replace segmentation. A trusted-network condition addresses user context, not server-to-server authorization. Raising a global user-risk threshold likewise does not constrain the compromised payroll workload’s lateral movement. Identity-based service policy directly contains the threat while preserving the required database flow.

The audit evidence shows excessive authorization, so the correction must be made to the group’s administrative permissions and scope. Zscaler’s Authentication Service role documentation explains that role-based administration assigns users or groups defined roles and permissions that control their level of administrative access. Zscaler also provides administrative entitlement management for assigning groups the required administrator roles. The administrator should identify the unauthorized actions in the audit logs, remove unneeded entitlements, restrict the role or tenant scope, and retest legitimate tasks. Department labels do not enforce administrative permissions. JIT provisioning can refresh identity data but does not correct an overprivileged role. Relaxing sign-on policy would reduce authentication security and has no connection to configuration authorization. Option C preserves necessary duties while removing access outside the group’s intended administrative area.

Option C expresses both business intent and security boundaries with explicit, ordered File Type Control rules. The narrow allow rule permits contractor uploads of archives only to the approved code repository. The broader rule then blocks archives and executables when the same group uses generic file-sharing applications. Placing the specific allow above the block prevents the general rule from denying the authorized workflow. Zscaler’s File Type Control overview supports policy criteria such as users, groups, applications, and file types. The File Type Control troubleshooting runbook explains that ZIA identifies actual file types using file signatures, rather than trusting extensions, which addresses renamed executables. A single enterprise block is unnecessarily broad. Out-of-band scanning is not a substitute for upload enforcement, and URL Filtering alone cannot reliably distinguish allowed archives from disguised executable content.

================