[2026年更新]ZDTAまとめセット試験ガイド練習からあなたのZDTA試験を合格させます！
準備ZDTA試験2026年最新のDigital Transformation Administrator無制限275問題
質問 # 90
A company observes risky uploads from unmanaged devices connecting over public Wi-Fi to cloud storage.
The devices intermittently fail posture checks, and logs show inconsistent category enforcement.
Which action places the stricter control where it will be applied consistently to off-network traffic?
- A. Deploy branch bandwidth classes that shape storage traffic in sublocations to reduce large upload attempts from remote users
- B. Add connector-level ZPA policies that restrict FQDNs for storage endpoints and deny remote TCP ports used by synchronization clients
- C. Create a ZIA rule set scoped to roaming users and unauthenticated sessions, positioned early in the policy order to enforce stronger Cloud App Control and URL Filtering
- D. Attach tenant-restriction profiles to a limited set of users in CASB and rely on inherited group mappings to constrain cloud activity
正解：C
解説：
ZIA is the correct enforcement service for internet and SaaS traffic from roaming devices. Zscaler documents that URL Filtering rules are evaluated in ascending numerical order, so an early, narrowly scoped rule prevents a later general rule from allowing the transaction. Zscaler also supports policies for unauthenticated traffic, which is important when identity or posture context is intermittently unavailable. Option C therefore applies stricter URL and Cloud App Control decisions to roaming users and the relevant unauthenticated fallback state. A limited CASB tenant restriction does not cover every affected session. ZPA protects private applications rather than general cloud-storage access. Branch bandwidth classes do not follow users on public Wi-Fi and only shape throughput; they do not enforce upload authorization or application controls.
質問 # 91
Does the Access Control suite include features that prevent lateral movement?
- A. No. Access Control Services will only control access to the Internet and cloud applications.
- B. Yes. The Cloud Firewall will detect network segments and provide conditional access.
- C. Yes. Controls for segmentation and conditional access are part of the Access Control Services.
- D. No. The endpoint firewall will detect network segments and steer access.
正解：C
解説：
Yes, theAccess Control suite includes controls for segmentation and conditional access, which are designed to prevent lateral movement within networks. These features allow organizations to restrict access between different segments and enforce policies that limit the spread of threats or unauthorized access within internal environments.
質問 # 92
An administrator needs to SSL inspect all traffic but one specific URL category. The administrator decides to create two policies, one to inspect all traffic and another one to bypass the specific category. What is the logical sequence in which they have to appear in the list?
- A. First the policy for the exception Category, then further down the list the policy for the generic "inspect all."
- B. Both policies are incompatible, so it is not possible to have them together.
- C. All policies both generic and specific will be evaluated so no specific order is required.
- D. First the policy for the generic "inspect all", then further down the list the policy for the exception Category.
正解：A
解説：
Zscaler inspection policies are order-sensitive: the first matching rule determines the inspection action. When an administrator needs to inspect everything except one URL category, the exception must appear above the broad inspect-all rule. Otherwise the generic rule matches first and the exception is never reached. Option B (First the policy for the exception Category, then further down the list the policy for the generic "inspect all.") is correct because the category-specific bypass must be evaluated before the generic inspection rule.
Why the other options are incorrect:
A). Both policies are incompatible, so it is not possible to have them together: The policies are compatible when ordered correctly. The specific bypass rule must be evaluated before the broad inspect-all rule.
C). First the policy for the generic "inspect all", then further down the list the policy for the exception Category: Putting the inspect-all rule first catches the traffic before the category exception can run. The category bypass must sit above the generic inspect rule.
D). All policies both generic and specific will be evaluated so no specific order is required: SSL inspection rules are order-sensitive. A broad generic rule placed above the exception can catch the traffic first and prevent the bypass rule from taking effect.
質問 # 93
A regional data center hosts a payroll web application that communicates with a database over TCP port 1433.
Recent telemetry shows attempted lateral movement from the compromised payroll web server to unrelated internal services. Contractors also have ZPA access to a separate internal wiki that resides in the same segment as the payroll application.
Which action should the administrator take to refine microsegmentation and reduce risk?
- A. Apply service-to-service policies tied to server identity so that the payroll application can reach the database on the required port, and deny other application servers from initiating flows to the database
- B. Configure a trusted-network condition that prioritizes corporate subnets so contractor sessions default to restricted routing policies
- C. Increase the global user risk-score threshold before allowing access to the wiki segment to gate contractor sessions
- D. Consolidate both applications into one broad segment and add IPS signatures to suppress suspicious traffic between servers
正解：A
解説：
Option A applies least privilege to the east-west workload flow that must remain available. Zscaler explains that microsegmentation uses identity-based, granular policy so each workload communicates only with resources required for its function, while unauthorized communication is blocked. The payroll server should therefore be permitted to reach the database only on TCP 1433, and unrelated servers should have no path to that database. The wiki should also be separated according to its distinct application identity and access requirements. Placing both applications in a broad segment preserves unnecessary reachability and increases the blast radius; IPS signatures do not replace segmentation. A trusted-network condition addresses user context, not server-to-server authorization. Raising a global user-risk threshold likewise does not constrain the compromised payroll workload's lateral movement. Identity-based service policy directly contains the threat while preserving the required database flow.
質問 # 94
A campus requires 1.5 Gbps of throughput to Zscaler Service Edges. The underlay is trusted, and the design explicitly excludes high availability.
Which option meets the bandwidth target with the minimum tunnel count?
- A. Provision two GRE tunnels associated with the same location and distribute flows through ECMP to achieve 1.5 Gbps
- B. Establish a single GRE tunnel with Path MTU Discovery enabled and defer scaling until usage grows
- C. Configure one IPsec peer to avoid GRE MTU concerns and rely on static routing to sustain the required throughput
- D. Define two IPsec peers and tune lifetimes to minimize renegotiation during peak demand
正解：A
解説：
Zscaler supports up to 1 Gbps per GRE tunnel when internal endpoint addresses are not source-NATed, so one tunnel cannot satisfy a 1.5 Gbps target. The GRE overview documents that limit, and Zscaler's traffic- forwarding reference architecture states that throughput above 1 Gbps can be handled by adding GRE tunnels.
Therefore, two GRE tunnels are the minimum capacity set among the choices. Traffic distribution must preserve flow or source consistency, and Zscaler notes that additional GRE tunnels should originate from unique public IP addresses to avoid repeated authentication and application-session issues. Path MTU Discovery does not increase the one-tunnel ceiling. Two IPsec tunnels provide only 800 Mbps in aggregate because the same reference architecture specifies 400 Mbps per IPsec tunnel. A single IPsec peer is consequently even further below the requirement.
質問 # 95
A location has a trusted network bypass configured. A Client Connector Forwarding Profile applies category controls and private app access. A new departmental rule is added to permit a niche collaboration suite.
Which action should be taken to mitigate the risk of unintended bypass of inspection for that suite when users are on the trusted network?
- A. Constrain the forwarding profile by limiting app segments and defer category enforcement until off- network conditions resume.
- B. Reduce the forwarding scope and rely on baseline firewall defaults to constrain traffic during office hours.
- C. Refine the trusted network bypass to exclude the collaboration suite ' s domains and ensure the forwarding profile can still apply inspection.
- D. Shift the departmental permit below the global acceptable use controls to discourage inadvertent matches at the edge.
正解：C
解説：
Answer B is correct. A Trusted Network bypass can send matching traffic directly instead of forwarding it through the Zscaler enforcement path. If the collaboration suite's domains remain inside that bypass, the departmental permit does not guarantee that category controls or inspection will be applied. The administrator should narrow the bypass so those domains are excluded from direct handling and are forwarded through the profile to ZIA or the appropriate Zscaler service. This preserves the trusted-network behavior for destinations that genuinely require it while restoring inspection for the new suite. Moving the departmental rule does not change traffic that never reaches the policy engine, and firewall defaults cannot substitute for Zscaler inspection. Deferring enforcement off-network also leaves an acknowledged on-network gap. See Zscaler's Forwarding Profile configuration and traffic-forwarding best practices.
質問 # 96
Which of the following DLP Notification methods can be used to forward a copy of the data that triggered the DLP policy to the auditor?
- A. SMS Text Message via PagerDuty
- B. Zscaler Client Connector pop-up message
- C. NSS Log Forwarding to SIEM
- D. Email Notification Template
正解：D
解説：
The Email Notification Template is the built#in mechanism for forwarding a copy of the exact content that triggered a DLP rule to your designated auditor via email.
質問 # 97
How does Zscaler ensure that sensitive structured data used in the EDM process is not stored in its cloud environment?
- A. By encrypting sensitive data directly before storing it in the cloud.
- B. By using an on-premises VM to index data and only sending hashed values to the cloud.
- C. By requiring customers to manually hash the data and upload it to the cloud.
- D. By storing sensitive structured data on servers managed by trusted Zscaler staff for enhanced security.
正解：B
解説：
Exact Data Match protects structured sensitive data by converting source values into secure hashes before they are used by Zscaler cloud enforcement. The on-premises EDM VM performs indexing locally so raw customer data is not uploaded into the Zscaler cloud. Only hashed values are used for matching. Option B (By using an on-premises VM to index data and only sending hashed values to the cloud) is correct because the VM automates indexing and sends hashed data, not clear sensitive records, to the cloud.
Why the other options are incorrect:
A). By storing sensitive structured data on servers managed by trusted Zscaler staff for enhanced security: Storing raw structured data on Zscaler-managed servers would create unnecessary exposure. EDM avoids this by sending hashed values, not the original data.
C). By requiring customers to manually hash the data and upload it to the cloud: Manual customer hashing is error-prone and not the EDM workflow. The on-premises VM automates hashing/indexing before values are sent to Zscaler.
D). By encrypting sensitive data directly before storing it in the cloud: Encrypting raw sensitive data before cloud storage still implies the data is being stored. EDM avoids that by sending hashes, not the original structured values.
質問 # 98
Which Zscaler Client Connector configuration setting allows administrators to assign a hosted PAC file to individual users?
- A. Traffic Steering in the App Profile
- B. Global Settings in the Forwarding Profile
- C. Global Settings in the App Profile
- D. Forwarding Profile Action in the Forwarding Profile
正解：A
解説：
Comprehensive and Detailed 100 to 150 words of Explanation From Zscaler Digital Transformation Administrator topics:
The hosted PAC file is assigned through Traffic Steering in a Zscaler Client Connector App Profile, making A correct. App Profile rules can be scoped to particular users or groups and contain the traffic-steering configuration applied to those endpoints. The administrator can reference the relevant hosted or custom PAC URL so Client Connector retrieves the file and uses its logic for forwarding and bypass decisions. A Forwarding Profile defines how Client Connector treats traffic in different network environments, but the user- specific App Profile provides the applicable assignment and traffic-steering settings. Global Settings do not provide the per-user hosted PAC association described in the question. Zscaler's App Profile configuration documentation places user traffic options within Traffic Steering and supports assigning profiles based on user and group criteria.
質問 # 99
When configuring Zscaler Private Access, what is the function of the Server Group?
- A. Maps App Connector Groups to Application Segments
- B. Maps Applications to Application Groups
- C. Maps FQDNs to IP Addresses
- D. Maps Applications to FQDNs
正解：C
解説：
A Server Group holds the actual backend endpoints - defined by FQDNs (or IPs) and ports - and effectively maps those FQDNs to their IP addresses so ZPA knows which hosts to steer traffic toward.
質問 # 100
What enables zero trust to be properly implemented and enforced between an originator and the destination application?
- A. Trusted network criteria designate the locations of originators which can be trusted.
- B. Connectivity between the originator and the destination application is over IPSec tunnels.
- C. Cloud firewall policies ensure that only authenticated users are allowed access to destination applications.
- D. Access is granted without sharing the network between the originator and the destination application.
正解：D
解説：
Zscaler Access Control Services support Zero Trust by enforcing segmentation and conditional access instead of allowing broad network reach. Preventing lateral movement requires connecting users to specific applications and limiting what they can discover or reach beyond that entitlement. Option B (Access is granted without sharing the network between the originator and the destination application) is correct because segmentation and conditional access are the controls that reduce lateral-movement risk.
Why the other options are incorrect:
A). Trusted network criteria designate the locations of originators which can be trusted: Trusted Network detection decides whether the device is on a known corporate network using signals such as DNS servers, search domains, gateways, or hostname resolution.
C). Cloud firewall policies ensure that only authenticated users are allowed access to destination applications:
Zscaler Cloud Firewall enforces network-service and application rules for non-web and firewall-controlled traffic.
D). Connectivity between the originator and the destination application is over IPSec tunnels: IPS inspects traffic inline for exploit signatures and attack patterns, then blocks or resets offending sessions.
質問 # 101
How is the relationship between App Connector Groups and Server Groups created?
- A. When a new Server Group is created it points to the App Connector Groups that provide visibility to this Server Group
- B. Both App Connector Groups and Server Groups are linked together via the Data Center element
- C. The relationship between App Connector Groups and Server Groups is established dynamically in the Zero Trust Exchange as users try to access Applications
- D. When you create a new App Connector Group you must select the list of Server Groups to which it provides visibility
正解：A
解説：
The relationship between App Connector Groups and Server Groups is configured when the Server Group is created or edited. The Server Group points to the App Connector Groups that have visibility to the applications, so ZPA knows which connectors can serve the private traffic. Option B (When a new Server Group is created it points to the App Connector Groups that provide visibility to this Server Group) is correct because Server Group configuration establishes the mapping.
Why the other options are incorrect:
A). The relationship between App Connector Groups and Server Groups is established dynamically in the Zero Trust Exchange as users try to access Applications: A Server Group groups application servers and maps them to App Connector Groups that can reach those servers.
C). Both App Connector Groups and Server Groups are linked together via the Data Center element: A Server Group groups application servers and maps them to App Connector Groups that can reach those servers.
D). When you create a new App Connector Group you must select the list of Server Groups to which it provides visibility: A Server Group groups application servers and maps them to App Connector Groups that can reach those servers.
質問 # 102
A log review shows requests to a sanctioned application being allowed despite a later rule intended to restrict access by time of day.
The rule set is:
* Allow the sanctioned application for All Employees
* Block the sanctioned application outside business hours for All Employees
* Log restricted-access hits
Which cause and risk are most consistent with this behavior?
- A. The initial allow rule matches first and stops further evaluation, so the time-of-day block never applies and access remains available after business hours
- B. The logging rule takes precedence because of its action type, preventing the block from being reached
- C. The time-of-day block inherits timing from device posture, which desynchronizes evaluation and produces inconsistent enforcement
- D. The sanctioned application category becomes invalid during SSL inspection, sending the request to a default allow path that bypasses time restrictions
正解：A
解説：
Option B is a classic rule-shadowing condition. Zscaler documents that URL Filtering rules stop at the first matching rule, and Cloud App Control rules likewise use an explicit numerical rule order. The first rule matches every employee request to the sanctioned application without checking time. The service therefore applies Allow and never reaches the later outside-business-hours block. This leaves the application available during the restricted period and can also explain the absence of expected restricted-access log hits. The corrective design is to place the narrower time-based block above the broad allow or add the required time condition to the applicable access rule. Device posture does not supply policy time, logging actions do not automatically override earlier matches, and SSL inspection does not invalidate the application category in the manner described.
質問 # 103
You recently deployed an additional App Connector to an existing app connector group. What do you need to do before starting the zpa-connector service?
- A. Check the status of the new App Connector in the administration portal
- B. Copy the group provisioning key to /opt/zscaler/var/provision key
- C. Monitor the peak CPU and memory utilization of the AC
- D. Schedule periodic software updates for the app connector group
正解：B
解説：
Before a new App Connector starts the connector service, it must be provisioned into the correct ZPA App Connector Group. The group provisioning key is copied to the connector's local provisioning-key path so the connector can enroll and join the intended group. Option A (Copy the group provisioning key to /opt/zscaler
/var/provision key) is correct because the provisioning key must be installed before starting zpa-connector.
Why the other options are incorrect:
B). Monitor the peak CPU and memory utilization of the AC: CPU and memory metrics can show connector load, but they do not prove the connector is registered, reachable, and healthy in ZPA service status.
C). Schedule periodic software updates for the app connector group: An App Connector Group is a set of connectors deployed near applications to provide outbound-only reachability.
D). Check the status of the new App Connector in the administration portal: Checking portal status is useful after deployment, but the scenario asks what to communicate before deployment so the VM/container team builds the connector correctly.
質問 # 104
Which are valid criteria for use in Access Policy Rules for ZPA?
- A. Department, SNI, Branch Connector Group, Machine Group
- B. SCIM Group, Time of Day, Client Type, Country Code
- C. Group Membership, ZIA Risk Score, Domain Joined, Certificate Trust
- D. Username, Trusted Network Status, Password, Location
正解：C
解説：
Valid criteria for Access Policy Rules in ZPA includeGroup Membership, ZIA Risk Score, Domain Joined, and Certificate Trust. These attributes allow granular policy decisions based on user identity, device posture, and risk context.
Options including password are invalid as passwords are not used as policy criteria; similarly, SNI and Branch Connector Group are more relevant to other controls. The study guide lists these user and device attributes explicitly as policy criteria within ZPA access policies.
質問 # 105
What enables zero trust to be properly implemented and enforced between an originator and the destination application?
- A. Trusted network criteria designate the locations of originators which can be trusted.
- B. Connectivity between the originator and the destination application is over IPSec tunnels.
- C. Cloud firewall policies ensure that only authenticated users are allowed access to destination applications.
- D. Access is granted without sharing the network between the originator and the destination application.
正解：D
解説：
Zero Trust is achieved by granting users application#level access without ever placing them on the same network as the destination, ensuring users can reach only the specific app and never the underlying network.
質問 # 106
Which of the following is a key feature of Zscaler Data Protection?
- A. DDoS protection
- B. Data loss prevention
- C. Stopping reconnaissance attacks
- D. Log analysis
正解：B
解説：
Data Protection provides comprehensive Data Loss Prevention (DLP) capabilities, inspecting content in motion to identify, block, or encrypt sensitive information based on policy.
質問 # 107
An administrator must apply file-type controls to a subset of users while ensuring evasion-resistant detection.
Which configuration most directly maps a file-type policy to a user group and role-based security requirements?
- A. Enable MIME-type validation in a baseline content policy and expect extension mismatches to be handled through application restrictions
- B. Create a File Type Control rule using magic-byte, MIME-type, and file-extension checks; scope it to the target SCIM group and device posture; and place it above broader catch-all rules
- C. Define a global File Type Control rule that blocks risky formats and rely on identity-based reporting to address group-level differences later
- D. Create a URL Filtering rule scoped to the department and reference a custom URL category that lists file extensions for the restricted formats
正解：B
解説：
Option C combines reliable file identification with precise identity and device scope. The official ZDTA Study Guide describes magic-byte analysis, MIME-type validation, and extension checking. Using all three reduces evasion through renamed extensions or misleading content types. Zscaler's File Type Control documentation supports rules scoped by groups, departments, and locations, so the target SCIM group can receive a stricter policy without imposing it globally. Adding device posture further distinguishes trusted and untrusted endpoints. The specific rule should appear above broader rules so it is evaluated first. A global block ignores role differences. MIME-only inspection leaves gaps when content is mislabeled. URL cate gories identify destinations, not the true format of transferred files. The combined rule provides the requested role-based and evasion-resistant enforcement.
質問 # 108
A managed device on a known corporate LAN cannot reach a private application through the Zero Trust Exchange because of forwarding behavior.
Which bypass configuration would enable access while respecting how policies are evaluated?
- A. Place a broader App Segment earlier in the rule list, conceding that misalignment could widen exposure and still fail to route the session.
- B. Introduce an Access Policy allow rule based on group membership, accepting that forwarding mismatches may still block sessions.
- C. Apply an Inspection Policy to the application traffic, acknowledging that added parsing may not resolve the routing path.
- D. Enable a Trusted Network bypass in the Client Forwarding Policy, recognizing that direct access on the corporate LAN limits dependency on ZPA routing.
正解：D
解説：
Answer B is correct. When the corporate LAN already provides a valid direct route to the private application, a Trusted Network bypass can tell Client Connector not to forward that application through ZPA on that network. Zscaler supports bypassing ZPA for an application when the user is on a trusted network, and Client Forwarding Policy rules are evaluated using application specificity and top-down, first-match logic. The trusted-network definition and bypass scope must therefore be narrow and stable so that the same traffic is still forwarded and protected when the device leaves the corporate LAN. A broader App Segment changes application matching but does not repair the forwarding path. Inspection Policy affects content handling, and an Access Policy allow cannot help if traffic never reaches the correct ZPA path. See Zscaler's Client Forwarding Policy overview and client forwarding configuration.
質問 # 109
Which of the following components is installed on an endpoint to connect users to the Zero Trust Exchange regardless of their location - home, work, while traveling, etc.?
- A. Private Service Edge
- B. IPSec/GRE Tunnel
- C. App Connector
- D. Client connector
正解：D
解説：
Zscaler Client Connector is the endpoint agent that connects users to the Zero Trust Exchange from any location. It handles authentication, traffic steering, tunnel creation, posture collection, and integration with ZIA, ZPA, and ZDX. Option A (Client connector) is correct because Client Connector is the endpoint component.
Why the other options are incorrect:
B). Private Service Edge: A Private Service Edge is an enforcement point deployed for private access, not a user endpoint component.
C). IPSec/GRE Tunnel: IPS inspects traffic inline for exploit signatures and attack patterns, then blocks or resets offending sessions.
D). App Connector: An App Connector connects users to private apps through ZPA. It is not the data- protection or SaaS control tested in this question.
質問 # 110
Which of the following is a key feature of Zscaler Data Protection?
- A. DDoS protection
- B. Data loss prevention
- C. Stopping reconnaissance attacks
- D. Log analysis
正解：B
解説：
Data Loss Prevention is the central feature of Zscaler Data Protection. It detects sensitive information using engines, dictionaries, labels, EDM/IDM, and contextual controls, then applies actions such as block, notify, coach, quarantine, or remediate. Option A (Data loss prevention) is correct because DLP is the named core feature for protecting sensitive data.
Why the other options are incorrect:
B). Stopping reconnaissance attacks: Stopping reconnaissance is about hiding attack surface. Data protection addresses exfiltration and accidental data loss.
C). DDoS protection: DDoS protection absorbs or blocks traffic floods. It does not inspect sensitive content leaving through web and cloud channels.
D). Log analysis: Log analysis helps detect and investigate events after collection. DLP use cases prevent the sensitive transfer itself.
質問 # 111
......
Zscaler ZDTA 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
注目のZDTAまとめセット試験ガイドは最速合格できます：https://www.goshiken.com/Zscaler/ZDTA-mondaishu.html
練習するZDTAにはGoShiken明確な練習であなたをZscaler Digital Transformation Administrator試験合格させます：https://drive.google.com/open?id=1i6QgTIsK8iMWyysx4rvVuVLoJA2jaDjd