Zscaler ZDTA Practice Exam

ZDTA practice test: what's covered

• Identity
• Connectivity (ZIA/ZPA)
• Access Control
• Cyberthreat Protection
• Data Protection
• ZDX
• Zero Trust Automation

Free ZDTA sample questions

1. A Zscaler administrator is onboarding a new tenant and wants users to authenticate with their existing corporate Okta credentials when accessing the Zscaler Zero Trust Exchange. Which identity protocol should be configured for this single sign-on flow?

   • A. SAML 2.0 with Okta configured as the identity provider and Zscaler as the service provider
   • B. RADIUS accounting forwarded from the App Connector to the Okta authentication server
   • C. Kerberos ticket-granting tickets exchanged directly between the endpoint and ZIA
   • D. Local user accounts manually provisioned in the Zscaler admin portal for each employee
   Show answer

   Correct: A. SAML 2.0 is the protocol Zscaler uses for SSO, with the external IdP (Okta) asserting identity to Zscaler as the service provider. RADIUS accounting is for session logging, not browser-based SSO, so it is incorrect. Kerberos is not used between endpoints and the cloud service. Manually provisioning local accounts defeats the purpose of federated SSO and does not scale, so it is wrong.

2. After integrating an identity provider, a Zscaler administrator notices that newly created users in Azure AD are not appearing automatically in the Zscaler portal and existing users are not being deprovisioned when disabled. Which mechanism resolves this gap?

   • A. Configure SCIM provisioning so the IdP pushes user and group lifecycle changes to Zscaler
   • B. Enable hosted PAC file distribution so the directory syncs through the browser
   • C. Switch the SSL inspection policy to bypass the identity provider domains
   • D. Increase the SAML assertion lifetime to keep stale sessions alive longer
   Show answer

   Correct: A. SCIM automates user and group provisioning and deprovisioning from the IdP into Zscaler, which is exactly the lifecycle problem described. A PAC file only controls traffic forwarding and carries no directory data, so it is incorrect. SSL inspection bypass is unrelated to provisioning. Extending the SAML assertion lifetime affects session length, not whether users sync, so it is wrong.

3. A security architect is hardening user authentication on the Zero Trust Exchange and wants identity to be the strongest signal in access decisions. Which capabilities support a robust identity foundation? (Choose TWO)

   • A. SAML-based single sign-on integration with the enterprise identity provider
   • B. SCIM synchronization of users and groups for accurate policy targeting
   • C. Static IP allow-lists replacing all user-based authentication entirely
   • D. Disabling multi-factor authentication to reduce login friction for users
   • E. Routing all SAML assertions through an unauthenticated guest portal
   Show answer

   Correct: A and B. SAML SSO and SCIM provisioning together give Zscaler trusted, current identity and group data, which is the foundation for identity-driven policy. Static IP allow-lists replace identity with network location, the opposite of zero trust, so they are incorrect. Disabling MFA weakens authentication rather than strengthening it. Routing assertions through an unauthenticated guest portal would break the trust chain, so it is wrong.

4. An administrator wants ZIA and ZPA access policies to reference organizational groups such as Finance and Engineering so that rules stay accurate as employees change teams. Where does Zscaler obtain these group memberships for policy matching?

   • A. From group attributes synchronized via SCIM or carried in the SAML assertion
   • B. From the reverse DNS records of each user's assigned workstation
   • C. From the MAC address vendor prefix observed on the local network
   • D. From the PAC file comments manually edited for every department
   Show answer

   Correct: A. Group membership reaches Zscaler through SCIM sync or SAML assertion attributes, letting policies reference real directory groups. Reverse DNS of a workstation reveals nothing about team membership, so it is incorrect. MAC vendor prefixes identify hardware makers, not departments. Hand-editing PAC file comments does not convey group data to policy engines, so it is wrong.

5. During a phased rollout, a Zscaler administrator must let a small pilot group authenticate before the full IdP integration is complete, without relying on the corporate directory. Which Zscaler option provides this interim authentication?

   • A. Hosted database (locally authenticated) accounts defined directly in the admin portal
   • B. A wildcard SAML certificate trusted by every browser on the internet
   • C. An anonymous bypass rule that skips authentication for the pilot subnet
   • D. A RADIUS challenge sent to the public DNS resolver for each user
   Show answer

   Correct: A. Zscaler's hosted database lets administrators create locally authenticated accounts, ideal for a pilot before full IdP federation. A wildcard SAML certificate trusted by all browsers is not a real authentication method and is a security risk, so it is incorrect. An anonymous bypass removes authentication entirely, which is not authenticating the pilot. RADIUS to a public DNS resolver is nonsensical, so it is wrong.

Last updated: 2026-10-19

ZDTA practice test FAQ

Related practice tests

• ZDTE practice test
• ZIA administrator practice test
• ZPA administrator practice test
• ZDX administrator practice test
• Client Connector practice test
• Cato SASE practice test