Question bank
Zscaler Digital Transformation Administrator
41 Zscaler Digital Transformation Administrator questions with the correct answer and a written explanation, organised across 6 exam domains.
- 41 questions
- 6 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Cloud Security Architecture
8 questions in this domain
- Question 1Single Choice
How does an App Connector establish connectivity between the private network and the Zscaler cloud in the Zscaler architecture?
- AOutbound TLS tunnels to the Zscaler cloudCorrect answer
- BInbound firewall rules for Zscaler traffic
- CPublic VPN concentrator connections
- DStatic IPsec tunnels to user devices
Why this is the answer
App Connectors create outbound-only TLS tunnels to Zscaler. No inbound firewall rule or VPN concentrator is needed, so the private network attack surface is reduced.
- Question 2Multiple Select
Which statements accurately describe how App Connectors are provisioned and registered to a Zscaler tenant? Select all that apply.
- AUnique Activation Key maps to the Zscaler tenantCorrect answer
- BDeployable on physical, virtual, and cloud hostsCorrect answer
- CRequires inbound firewall rules for registration
- DOne connector gives full high availability
Why this is the answer
Each connector uses a unique Activation Key for tenant registration. Connectors can be deployed on physical, virtualized, or public cloud platforms; a single connector cannot ensure high availability.
- Question 3Interactive
Review the JSON registration payload for an App Connector. Which field associates this connector with the correct Zscaler tenant?
- Aactivation_keyCorrect answer
- Bname
- Cenvironment
- Dlabel
Why this is the answer
The activation_key field associates a new connector with the intended Zscaler tenant. Name, environment, and label are descriptive and do not determine tenant membership.
- Question 4Single Choice
What is the primary purpose of the SCIM protocol when exchanging identity data between an IdP and Zscaler?
- AAutomates identity data exchange with ZscalerCorrect answer
- BAuthenticates users through SAML assertions
- CEstablishes App Connector TLS tunnels
- DCreates App Connector activation keys
Why this is the answer
SCIM automates exchange of user identity attributes between the IdP and Zscaler. It supports real-time provisioning and deprovisioning, unlike authentication protocols such as SAML.
- Question 5Multiple Select
Which statements correctly contrast the provisioning behaviors of SCIM and Just-in-Time provisioning in Zscaler? Select all that apply.
- ASCIM automates identity provisioning and deprovisioningCorrect answer
- BJIT creates accounts after the first SAML loginCorrect answer
- CSAML continuously updates user group attributes
- DJIT fully replaces SCIM for group sync
Why this is the answer
SCIM handles identity lifecycle and group synchronization. JIT creates a user only after the first SAML authentication; JIT does not provide deep, continuous attribute synchronization.
- Question 6Interactive
Review the JSON attribute mapping shown below. What is the problem with the groups mapping in this SCIM configuration?
- ACase mismatch in the groups attribute mappingCorrect answer
- BEmail should map to the department field
- CSCIM cannot map group attributes
- DThe protocol version is unsupported
Why this is the answer
The groups source key and Groups target value are case-sensitive and not identical, which can break group synchronization and cause policy access issues.
- Question 7Single Choice
After an App Connector has been provisioned, what health and connectivity information must be verified in the Zscaler Admin Portal?
- AConnection status and latencyCorrect answer
- BMDM enrollment profile assignment
- CUser SAML authentication tokens
- DFirewall rule placement logs
Why this is the answer
After provisioning, administrators should verify the connector's operational status and latency in the portal to ensure stable tunnels and accessible applications.
- Question 8Multiple Select
In which of the following environments can a Zscaler App Connector be provisioned? Select all that apply.
- APhysical serversCorrect answer
- BVMware and Hyper-V virtual machinesCorrect answer
- CAWS, Azure, and GCP cloud instancesCorrect answer
- DMainframe LPAR partitions
Why this is the answer
App Connectors are supported on physical servers, hypervisors such as VMware/Hyper-V, and public cloud platforms like AWS, Azure, and GCP. Mainframe LPAR is not listed.
Deployment
7 questions in this domain
- Question 9Single Choice
In the Zscaler deployment model, what is the main function of the unique Activation Key when a new App Connector is introduced?
- ARegisters connector to Zscaler tenantCorrect answer
- BCreates SAML user certificate
- CAssigns password to end users
- DEnables MDM profile download
Why this is the answer
The Activation Key is the primary mechanism for associating a new App Connector with the correct Zscaler tenant. It is not a user authentication token, SAML certificate, or MDM setting.
- Question 10Multiple Select
Which deployment environment types are valid for placing a Zscaler App Connector and must be considered before provisioning begins?
- APhysical serversCorrect answer
- BVMware or Hyper-V virtual machinesCorrect answer
- CAWS, Azure, or GCP instancesCorrect answer
- DPerimeter firewall appliances
Why this is the answer
Provisioning may occur on physical servers, VMware/Hyper-V VMs, and AWS/Azure/GCP instances. Firewall appliances do not host App Connectors and inbound firewall rules are not required.
- Question 11Interactive
Review the connector bootstrap YAML. Which field is responsible for associating this connector with the correct Zscaler tenant?
- Aactivation_keyCorrect answer
- Benvironment
- Chostname
- Dregion
Why this is the answer
The Activation Key is the primary mechanism for associating a new App Connector with a specific Zscaler tenant. Other fields are environmental or descriptive and do not perform tenant registration.
- Question 12Single Choice
Which Zscaler provisioning feature automates the exchange of user identity information between the identity provider and the Zscaler cloud?
- ASCIMCorrect answer
- BApp Connector
- CActivation Key
- DSAML certificate
Why this is the answer
SCIM is the industry-standard protocol that automates identity exchange between the IdP and Zscaler. It supports real-time provisioning and de-provisioning, unlike authentication mechanisms such as SAML.
- Question 13Multiple Select
Which statements about attribute mapping from an identity provider to Zscaler are accurate? Select all that apply.
- ALinks IdP email or department to ZscalerCorrect answer
- BMust use exact case-sensitive field namesCorrect answer
- CEnables granular attribute-based access controlCorrect answer
- DUses SAML to continuously update groups
Why this is the answer
Attribute mapping links IdP fields, such as email or department, to Zscaler fields. Exact naming is required, and mapping supports ABAC policies. SAML authenticates users but does not continuously update groups; SCIM does.
- Question 14Interactive
The identity message includes user group assignments. Which Zscaler capability is directly supported by this kind of group synchronization?
- AWrite policies based on directory groupsCorrect answer
- BOpen inbound firewall ports automatically
- CCreate TLS tunnels from the data center
- DReplace App Connector load balancing
Why this is the answer
Group synchronization mirrors organizational groups from the IdP to Zscaler, so administrators can create policies based on directory groups and keep permissions aligned with role changes.
- Question 15Single Choice
Which statement correctly describes how Just-in-Time provisioning creates user accounts in Zscaler for SAML users?
- ACreates account at first successful SAML loginCorrect answer
- BContinuously updates groups from the IdP
- CReplaces SCIM for all lifecycle changes
- DRequires an MDM enrollment profile first
Why this is the answer
JIT provisioning creates user accounts at the moment of their first successful SAML authentication. It reduces manual overhead but focuses on authentication, not the deep attribute synchronization provided by SCIM.
Operations
6 questions in this domain
- Question 16Single Choice
How does an App Connector establish connectivity with the Zscaler cloud?
- AOutbound TLS tunnelCorrect answer
- BInbound firewall rule
- CVPN concentrator
- DSAML direct connection
Why this is the answer
App Connectors initiate all communication through outbound TLS tunnels, so no inbound ports or VPN concentrators are required.
- Question 17Multiple Select
Which deployment environments are supported for provisioning Zscaler App Connectors?
- APhysical serversCorrect answer
- BVirtual machines on VMware or Hyper-VCorrect answer
- CCloud-native instances on AWS, Azure, or GCPCorrect answer
- DBrowser-based endpoint connectors
Why this is the answer
App Connectors can be provisioned on physical, virtualized, or cloud-native environments. They are not installed as browser extensions on user endpoints.
- Question 18Interactive
What action is triggered when the JSON payload in the code block is received by the SCIM provisioning service?
- ADeactivate the user accountCorrect answer
- BCreate the user account
- CAuthenticate the user with SAML
- DAssociate an App Connector
Why this is the answer
The active field equal to false triggers de-provisioning. SCIM revokes access, while SAML only handles authentication and App Connectors are unrelated.
- Question 19Single Choice
Which protocol automates user provisioning and de-provisioning between an identity provider and Zscaler?
- ASCIMCorrect answer
- BSAML
- CLDAP
- DOAuth
Why this is the answer
SCIM is the industry standard for automated identity synchronization. SAML supports authentication but not automated lifecycle management.
- Question 20Multiple Select
Which statements about App Connector deployment are correct?
- AA unique activation key registers the connector to the correct tenantCorrect answer
- BAn inbound firewall rule must be opened for the cloud
- CApp Connector clusters provide high availabilityCorrect answer
- DConnector status is verified in the Zscaler Admin PortalCorrect answer
Why this is the answer
Activation keys associate connectors with the correct tenant. Clusters provide high availability, and portal monitoring verifies health. Inbound rules are not required.
- Question 21Interactive
An identity provider sends the SAML attribute shown in the code block during authentication. How can Zscaler use this mapped attribute?
- AGroup-based security policiesCorrect answer
- BAutomatic user de-provisioning
- CActivation key generation
- DConnector tunnel setup
Why this is the answer
The group attribute is used to apply group-based access policies in Zscaler. De-provisioning is handled by SCIM, not through SAML assertions.
Policy Configuration
8 questions in this domain
- Question 22Single Choice
Which mechanism is used to associate a newly deployed App Connector instance with a specific Zscaler tenant?
- AActivation KeyCorrect answer
- BUser Authentication Token
- CSAML Certificate
- DInbound Firewall Rule
Why this is the answer
A unique Activation Key is the primary mechanism that associates a new App Connector with a specific Zscaler tenant. User tokens and SAML certificates do not perform connector registration.
- Question 23Multiple Select
Which statements about App Connector outbound-only connectivity are true? Select all that apply.
- AApp Connectors initiate all communications through TLS tunnels to the Zscaler cloud.Correct answer
- BZscaler must reach App Connectors through inbound firewall rules.
- CEliminating inbound firewall rules and VPN concentrators reduces the private network attack surface.Correct answer
- DAn inbound VPN concentrator is required to establish the outbound TLS tunnel.
Why this is the answer
App Connectors use outbound TLS tunnels to reach the Zscaler cloud. This removes the need for inbound firewall rules and VPN concentrators, reducing the private network attack surface.
- Question 24Interactive
Review the synchronization flow shown in the code block. Which protocol is represented by the bracketed step?
- ASCIMCorrect answer
- BSAML
- CJIT Provisioning
- DLDAP
Why this is the answer
SCIM automates user identity provisioning and de-provisioning between the IdP and Zscaler. When a user is disabled in the IdP, SCIM can revoke access to Zscaler services.
- Question 25Single Choice
Which environments can host App Connector provisioning? Choose the best answer.
- APhysical servers, virtual machines, or cloud-native instancesCorrect answer
- BOnly VMware and Hyper-V virtual machines
- COnly AWS, Azure, and GCP cloud instances
- DOnly Zscaler-provided physical appliances
Why this is the answer
App Connector provisioning supports diverse environments, including physical servers, VMware/Hyper-V virtual machines, and cloud-native instances in AWS, Azure, or GCP.
- Question 26Multiple Select
Which items should be verified to confirm a provisioned App Connector is healthy? Select all that apply.
- AApp Connector status in the Zscaler Admin PortalCorrect answer
- BLatency between the App Connector and Zscaler cloudCorrect answer
- CPrivate application reachability through the established tunnelCorrect answer
- DCreation of an inbound firewall rule to the App Connector
Why this is the answer
After provisioning, administrators must verify connector status and latency in the Admin Portal to ensure the tunnel is stable and applications are reachable. Inbound rules are unnecessary.
- Question 27Interactive
Review the deployment plan shown in the code block. What should be changed to avoid the single point of failure trap?
- AProvision multiple connectors in a load-balanced clusterCorrect answer
- BReplace VMware with a physical server
- CAdd an inbound firewall rule
- DRemove the Activation Key
Why this is the answer
Provisioning only one App Connector for a business-critical application creates a single point of failure. Multiple connectors in a cluster provide high availability and load balancing.
- Question 28Single Choice
Which statement most accurately defines SCIM?
- AA protocol that automates the exchange of user identity information between an IdP and ZscalerCorrect answer
- BA protocol that authenticates users through cryptographically signed assertions
- CA method to create user accounts when users first authenticate through SAML
- DA mechanism to open outbound-only TLS tunnels from App Connectors
Why this is the answer
SCIM is an industry-standard protocol for automating identity information exchange between the IdP and Zscaler. SAML handles authentication, and JIT creates accounts on first login.
- Question 29Multiple Select
Which statements correctly distinguish SAML from SCIM? Select all that apply.
- ASAML is used for authentication, while SCIM is used for identity management.Correct answer
- BSCIM sends signed assertions containing identity claims to Zscaler.
- CSAML alone automatically keeps group memberships synchronized after every authentication.
- DSCIM enables automated provisioning and de-provisioning based on the IdP user record.Correct answer
Why this is the answer
SAML authenticates users and sends signed assertions. SCIM manages identity lifecycles by provisioning and de-provisioning users. SAML alone does not continuously synchronize group attributes.
Reporting & Analytics
6 questions in this domain
- Question 30Single Choice
How does an App Connector begin all communication with the Zscaler cloud?
- AThe App Connector initiates outbound TLS tunnels to the Zscaler cloud.Correct answer
- BZscaler uses inbound firewall rules to reach into the App Connector.
- CThe App Connector sends open UDP broadcasts to discover the Zscaler cloud.
- DThe IdP creates a persistent VPN tunnel directly to the App Connector.
Why this is the answer
App Connectors use outbound-only connectivity by initiating TLS tunnels to the Zscaler cloud, eliminating inbound firewall rules and VPN concentrators.
- Question 31Multiple Select
Which statements about the App Connector Activation Key are correct? Select all that apply.
- AIt registers the App Connector to the correct Zscaler administrative tenant.Correct answer
- BIt authenticates end users when they attempt to access Zscaler services.
- CIt is the primary mechanism for associating a new App Connector with a specific Zscaler tenant.Correct answer
- DIt replaces the SAML certificate required by the identity provider.
Why this is the answer
The Activation Key associates a new App Connector with a specific Zscaler tenant. It is not for user authentication and is not a replacement for SAML certificates.
- Question 32Interactive
Review the provisioning file shown in the code block. Which deployment environment does this configuration target?
- APhysical server
- BVMware virtual machineCorrect answer
- CAWS native instance
- DAzure native instance
Why this is the answer
The configuration file identifies a VMware-based environment. App Connectors can be provisioned in virtual machines such as VMware or Hyper-V, or in cloud-native environments.
- Question 33Single Choice
After an App Connector is provisioned, where should an administrator verify its operational status?
- AZscaler Admin PortalCorrect answer
- BIdentity Provider dashboard
- CLocal firewall management console
- DCompany file server
Why this is the answer
The health and connectivity of the App Connector must be verified within the Zscaler Admin Portal, where monitoring of status and latency is available.
- Question 34Multiple Select
Which practices help maintain high availability and reliable App Connector connectivity? Select all that apply.
- AMonitor connection status and latency after provisioning.Correct answer
- BProvision multiple App Connectors in a cluster for load balancing.Correct answer
- COpen an inbound firewall rule so Zscaler can reach the App Connector.
- DDeploy a single App Connector and avoid redundancy for critical applications.
Why this is the answer
Monitoring health metrics and provisioning multiple connectors in a cluster help ensure stability and high availability. Inbound firewall rules and single-instance deployments are not recommended.
- Question 35Interactive
Review the identity provider configuration in the code block. Why will user de-provisioning events not be synchronized to Zscaler?
- AThe configuration lacks a TLS tunnel.
- BSCIM provisioning is disabled, so identity changes are not automatically exchanged.Correct answer
- CSAML assertions invalidate user accounts after expiration.
- DActivation keys are not present in the JSON.
Why this is the answer
SCIM is the protocol used to automate identity exchange and enable real-time de-provisioning. With SCIM disabled, disabled users will not be automatically synchronized to Zscaler.
Troubleshooting
6 questions in this domain
- Question 36Single Choice
What is the primary mechanism for associating a new App Connector instance with a Zscaler tenant?
- AActivation KeyCorrect answer
- BSAML certificate
- CSCIM bearer token
- DVPN concentrator
Why this is the answer
A unique Activation Key associates an App Connector with a specific Zscaler tenant, ensuring automatic registration to the correct administrative domain.
- Question 37Multiple Select
Which statements correctly describe App Connector connectivity to the Zscaler cloud? Select two.
- AApp Connectors initiate all communication via outbound TLS tunnels.Correct answer
- BZscaler must be allowed to connect inbound to the App Connector.
- CThe model removes the need for risky inbound firewall rules and VPN concentrators.Correct answer
- DPrivate applications must be exposed directly to the Internet.
Why this is the answer
App Connectors use outbound-only TLS tunnels to the Zscaler cloud, reducing attack surface by eliminating inbound firewall rules and VPN concentrators.
- Question 38Interactive
In the displayed App Connector registration output, what action should be taken next to complete provisioning?
- AEnter the unique Activation Key during provisioningCorrect answer
- BOpen an inbound firewall port to Zscaler
- CInstall a SAML certificate in the connector
- DWait for SCIM automatic registration
Why this is the answer
The output shows that no Activation Key was entered. A unique Activation Key is required to register the App Connector with the Zscaler tenant.
- Question 39Single Choice
After provisioning an App Connector, where should an administrator verify its connection status?
- AZscaler Admin PortalCorrect answer
- BLocal DNS server
- CIdentity Provider dashboard
- DOn-premises firewall console
Why this is the answer
Once provisioned, the App Connector status must be verified within the Zscaler Admin Portal to ensure the tunnel is stable and applications are reachable.
- Question 40Multiple Select
Which environments are supported for deploying App Connectors? Select all that apply.
- APhysical serversCorrect answer
- BVMware or Hyper-V virtual machinesCorrect answer
- CCloud-native instances in AWS, Azure, or GCPCorrect answer
- DMobile device containers
Why this is the answer
App Connector provisioning can occur on physical servers, virtual machines, or cloud-native instances, but mobile device containers are not supported.
- Question 41Interactive
The SCIM mapping shown is active. What can happen if the IdP sends an attribute name that does not match the mapped field exactly?
- AAttribute-based policies may deny access or be bypassedCorrect answer
- BThe user is immediately deprovisioned
- CThe App Connector Activation Key is revoked
- DThe SAML assertion is encrypted incorrectly
Why this is the answer
Exact field names and case sensitivity matter in SCIM attribute mapping. A mismatch can prevent correct synchronization and lead to access denials or policy bypasses.
Frequently asked questions
Everything about the Zscaler Digital Transformation Administrator question bank and how to use it.