Zscaler Updated ZDTA Exam Questions and Answers by meredith

Option A addresses the precise risk: an encrypted, password-protected file cannot be fully inspected or detonated inline, so it must not be treated as known safe. ZIA can apply a File Type Control action to unscannable files, allowing the organization to block the download according to its risk policy rather than permitting content that malware engines cannot examine. Zscaler’s malware-protection security-exception guidance identifies allow or block handling for files that cannot be scanned, and its policy-reason reference includes unscannable-file outcomes. Lowering DLP thresholds targets data-loss detection and would create unrelated false positives. Tenant-wide restrictions are disproportionate to a single encrypted download. API scanning can complement inline inspection for sanctioned SaaS data, but disabling inline control would remove protection at the moment of access and would not make the encrypted file inspectable.

================

Advanced Threat Protection defends users from malicious active content, phishing, exploit behavior, C2 callbacks, and risky web destinations. It works as part of ZIA ' s inline security stack, often alongside TLS inspection, Cloud Sandbox, DNS security, IPS, and URL categorization. Option C (Malicious active content) is correct because malicious active content is the security object ATP is designed to detect and block.

Why the other options are incorrect:

A. Vulnerable JavaScripts: Vulnerable JavaScript describes risky script behavior or client-side code, but it is narrower than the full ATP active-content category.

B. Large iFrames: An iFrame is an embedded page frame; suspicious iFrames can be a signal, but size alone is not the ATP protection category.

D. Command injection attacks: Command injection targets an application or server by passing operating-system commands through vulnerable input fields.

The successful upload is explained by DLP rule precedence, not URL reputation or threat sensitivity. Zscaler documents that, by default, inline DLP rules are evaluated according to rule order and evaluation stops at the first match. The Finance user satisfies the earlier departmental allow rule, so the later global block is not reached. The data-protection owner should narrow or reposition the exception so regulated-data blocking takes precedence for generic file-sharing destinations. If the organization enables Evaluate All Rules, it must instead validate the configured action-selection behavior and matching engines because evaluation differs from default first-match mode. URL-risk thresholds and Advanced Threat Protection govern destination or threat risk, not sensitive-content authorization. Lowering OCR sensitivity would weaken content detection and could create additional data-loss gaps. Option A directly corrects the policy condition shown in the logs.

Option D blocks both indicator types at the appropriate enforcement layers. Hard-coded IP callbacks can be matched through a destination IP group referenced by a Cloud Firewall Drop rule, while domain-based callbacks can be denied through a custom URL category and URL Filtering policy. Positioning the specific Firewall denial before generic outbound allows ensures that it is evaluated. Zscaler’s Destination IP Group documentation explains how IP addresses, FQDNs, and URL categories are grouped for Firewall policy. The URL Filtering overview documents rules based on URL categories, users, groups, and other criteria. Browser Isolation permits controlled rendering and is not the correct response for confirmed command-and-control infrastructure. TLS inspection alone does not constitute a deny decision. Risk-based page scoring is less deterministic than explicitly blocking known indicators and does not adequately address hard-coded IP callbacks.

================