Zscaler Updated ZDTA Exam Questions and Answers by zidane

A watering-hole attack compromises a legitimate website or service that the intended victims already trust and commonly visit. The attacker plants malicious active content, such as injected JavaScript or exploit code, so users are infected during normal browsing instead of being lured to an obviously suspicious site. The answer is Option D (Phishing, Exploit Kits, Watering Holes, Pre-existing Compromise) because it specifically describes malware hosted on a commonly accessed service, which is the defining trait of this attack type.

Why the other options are incorrect:

A. Malware downloads from web pages: Web-page malware downloads are one delivery method. The question asks for the common delivery mechanism set, which includes phishing, exploit kits, watering holes, and pre-existing compromise.

B. Personal emails, company documents, OneDrive: Email and webhooks forward alerts to people or third-party systems for response workflows.

C. Spam, exploit kits, USB drives, video streaming: Exploit kits automate exploitation after a victim reaches malicious content. They can be used inside an attack chain, but the scenario is naming the watering-hole delivery pattern.

ZDX includes endpoint and network-path visibility, including Wi-Fi health indicators. A poor signal can appear in device health telemetry and in Cloud Path Probe context, allowing the administrator to separate a local wireless problem from Zscaler, ISP, or application issues. Option D (Yes, a low Wi-Fi signal may be seen in either the results of a Cloud Path Probe or in the device health Wi-Fi signal indicator) is correct because Wi-Fi signal degradation is visible through ZDX telemetry.

Why the other options are incorrect:

A. Yes, the Wi-Fi hop latency is shown on a cloud path probe: Wi-Fi signal and Wi-Fi hop latency are endpoint/local-network indicators used by ZDX troubleshooting.

B. Yes. but the current Wi-Fi signal strength is only displayed when doing a deep trace: Deep Trace is a detailed diagnostic capture; it is useful, but slower and more manual than Y-Engine root-cause analysis.

C. No, ZDX only works on hardwired devices: ZDX works on supported endpoints running Client Connector, including devices on Wi-Fi. It can expose Wi-Fi signal problems instead of requiring wired-only access.

Answer D is correct. The high-value rule protects only the applications within its scope. Broad contractor or employee allow rules can still match other internal applications without verifying device posture. Each role-specific allow must therefore require the intended SAML or SCIM identity criteria and compliant posture together, so an unmanaged device cannot qualify merely because its user belongs to an allowed group. The posture-gated sensitive-application rule should remain above broader role rules, followed by the explicit high-value block. Moving the block above the valid posture-based allow would deny compliant users as well. Adding only a Trusted Network condition substitutes location for device trust, and changing unrelated fields does not ensure identity and posture are jointly required. ZPA supports AND and OR operators and first-match rule processing. See Zscaler’s Access Policy overview and Access Policy configuration.

A phased rollout limits the number of users exposed to a defective release and creates decision points before wider deployment. Zscaler’s Client Connector App Store update documentation supports phased rollout of selected Client Connector versions to selected groups by day and percentage. Administrators can begin with IT or pilot users, monitor enrollment, application health, tunnel behavior, authentication failures, and support volume, and then expand only when the cohort is stable. Version assignments and a tested revert path allow an affected group to return to a known-good release. A universal weekend delay increases vulnerability exposure without validating compatibility. An immediate global push maximizes the blast radius. Random timing reduces concurrency but is not controlled validation and depends on user complaints for detection. Option C provides measurable progression, bounded risk, and recoverability.