Zscaler utilized a Zero Trust Network Architecture (ZTNA) for segmentation in an environment.
Which of the following prevents lateral movement within an organization?

• A. Move all applications into the DMZ
• B. Allow access to all resources on the network via VPN
• C. Connect users to applications using Identity, device posture, and access policies
• D. Turn on all host based firewalls

A microsegmentation policy set contains a broad "allow employees to internal applications" rule before more specific controls. An incident review found SMB access from non-finance hosts to a finance file share.
Which refinement best addresses the unintended access while improving the internal security posture?

• A. Insert deception assets in the finance segment to divert suspicious SMB traffic away from the file share and collect telemetry
• B. Tighten URL Filtering for internal destinations so SMB-related domains resolve poorly in non-finance contexts
• C. Add bandwidth QoS constraints to the internal applications segment so non-finance SMB attempts are deprioritized at runtime
• D. Reorder the rules so the deny for non-finance SMB is evaluated before broad employee allows, and scope the SMB policy to finance hosts and device posture

What does an Endpoint refer to in an API architecture?

• A. An end-user device like a laptop or an OT/IoT device
• B. Zscaler public service edges
• C. Zscaler API gateway providing access to various components
• D. A URL providing access to a specific resource

Which approach minimizes disruption when deploying Client Connector software updates across a heterogeneous user base while maintaining the ability to recover from defects?

• A. Randomize update timing for each device group to spread the effect across multiple hours and days, relying on support tickets to detect failures
• B. Use staged rollout rings with assigned versions for selected groups, monitor deployment health in the Client Connector dashboard, and retain a revert path for cohorts that show instability
• C. Immediately push the latest version to every segment through one channel to reduce fragmentation, and delay monitoring until users report problems
• D. Defer all upgrades to weekend maintenance windows to reduce peak risk, accepting prolonged exposure to known vulnerabilities

A platform team deploys Bandwidth Control and firewall policy changes through an API. After a large rollout, users report sporadic application slowdowns, yet the monitoring team finds gaps in telemetry for the same time windows.
Which action best prevents these performance issues from persisting and going undetected in similar rollouts?

• A. Increase API client-token lifetimes to reduce HTTP 401 errors and stabilize automation during policy pushes
• B. Restrict automation runs to weekly windows to minimize configuration changes that may obscure trend lines
• C. Aggregate logs monthly and perform retrospective correlation to avoid noisy short-term fluctuations in metrics
• D. Add an implementation step that validates monitoring subscriptions and exports ZDX and Firewall Insights baselines before applying policy changes through APIs