Zscaler Updated ZDTA Exam Questions and Answers by josephine

ZIA Malware Protection is an inline security control that blocks malicious files or objects detected through signatures, reputation, and threat-intelligence checks. The policy action must stop the malicious transfer rather than simply route, isolate, or change TLS behavior. Option C (Block) is correct because Block is the malware policy action that prevents the identified malicious content from reaching the user.

Why the other options are incorrect:

A. Isolate: Isolate sends a browser session to a remote isolation environment. Malware Policy enforcement is simpler: detected malware should be blocked.

B. Bypass: Bypass skips an inspection or control path. A malware policy is meant to stop known malicious content, not exempt it from enforcement.

D. Do Not Decrypt: SSL/TLS bypass tells the proxy to pass encrypted traffic without decrypting it for content inspection.

DLP notification templates can send evidence to the right reviewer or auditor when a policy is triggered. An email notification template is the mechanism that can include or forward a copy of the data that matched the DLP rule, depending on policy configuration and privacy requirements. Option A (Email Notification Template) is correct because it is the DLP notification method used for auditor review.

Why the other options are incorrect:

B. NSS Log Forwarding to SIEM: NSS forwarding sends logs to a SIEM for analysts. End-user DLP coaching or notification is handled by user-facing notification/workflow channels.

C. SMS Text Message via PagerDuty: PagerDuty SMS alerts are operations notifications. The DLP user-notification method in the question is meant to inform or coach the user directly.

D. Zscaler Client Connector pop-up message: Zscaler Client Connector is the endpoint agent that steers traffic, authenticates users, reports posture, and supplies ZDX telemetry.

The Security Alerts dashboard summarizes threat impact so administrators can prioritize investigation. The graph showing Top 5 Threats by Systems Impacted identifies which threats are affecting the largest number of systems during the selected period. Option C (Top 5 Threats by Systems Impacted) is correct because it is the impact-oriented alert view.

Why the other options are incorrect:

A. Top 5 Malware Programs Detected: Top malware programs would list malware families by name. The Alerts dashboard graph being tested summarizes threats by the number of impacted systems.

B. Top 5 Viruses by Region: Viruses by region would be a geographic malware report. The Security Alerts widget is focused on the top threats and their system impact.

D. Top 5 Unified Threat Yara Options: YARA-style options are malware-pattern rules, not the dashboard summary metric being asked about.

Botnet Protection targets command-and-control behavior, including known C2 destinations, suspicious command traffic, and unknown C2 patterns detected through analytics or AI/ML. IPS and YARA-style content analysis are used to identify C2-like traffic and malicious patterns, not general malware categories alone. Option A (Command and Control Traffic) is correct because Command and Control traffic is the botnet behavior being protected against.

Why the other options are incorrect:

B. Ransomware: Ransomware encrypts or extorts data after compromise. It is not the callback/C2 category for outbound spyware communication.

C. Trojans: Trojans disguise malicious code as legitimate software. Spyware callback protection targets outbound communication from spyware to its controller.

D. Adware/Spyware Protection: Adware/spyware protection is a broad category. The tested feature is the specific spyware callback protection control.