A company must grant engineers and finance staff access to different private resources. After rollout, all users have access to both sets of resources.
Which action should the administrator take to tighten least privilege while keeping access operational?

• A. Retain the current forwarding scope and add a location-based condition to Access Policy to restrict engineers who access the site from off-campus networks
• B. Split the Application Segments by FQDN, scope Client Forwarding Policy appropriately, and define a separate Access Policy for each authorized group
• C. Consolidate both applications into one Application Segment with a single Allow rule and relax posture criteria to tolerate posture-probe instability
• D. Move posture checks to an inspection policy and apply a department attribute in a broad Allow rule so Client Connector can continue forwarding wide address ranges

A manufacturing firm is merging with a subsidiary that uses a separate identity provider. A ZPA Access Policy for an engineering CAD application uses SCIM groups for authorization. A new administrator authenticates successfully through SAML and presents the Engineering claim, but the subsidiary's SCIM synchronization is delayed, so the administrator does not appear in the expected group in ZIdentity.
Which action should the ZPA administrator take to avoid inconsistent access while preserving auditability?

• A. Change identity-provider routing so the engineer authenticates through the parent company's identity provider, accepting misalignment with the subsidiary's directory mappings
• B. Reconfigure the policy to use NameID for authorization, accepting reduced traceability of group criteria
• C. Create a local ZIdentity group with provisional engineering membership, accepting drift from the directory of record
• D. Initiate a SCIM resynchronization and validate the user's group membership in ZIdentity, while keeping the Access Policy bound to SCIM groups

A user is accessing a private application through Zscaler with SSL Inspection enabled. Which certificate will the user see on the browser session?

• A. No certificate, as the session is decrypted by the Service Edge
• B. A self-signed certificate from Zscaler
• C. Zscaler generated MITM Certificate
• D. Real Server Certificate

A campus requires 1.5 Gbps of throughput to Zscaler Service Edges. The underlay is trusted, and the design explicitly excludes high availability.
Which option meets the bandwidth target with the minimum tunnel count?

• A. Configure one IPsec peer to avoid GRE MTU concerns and rely on static routing to sustain the required throughput
• B. Establish a single GRE tunnel with Path MTU Discovery enabled and defer scaling until usage grows
• C. Define two IPsec peers and tune lifetimes to minimize renegotiation during peak demand
• D. Provision two GRE tunnels associated with the same location and distribute flows through ECMP to achieve 1.5 Gbps

Which of the following statements accurately reflects Zscaler ' s file size limitation for Malware Protection scans?

• A. Zscaler scans files up to 400 MB.
• B. Zscaler scans all files regardless of size.
• C. Zscaler scans files only if they are below 100 MB.
• D. Zscaler scans files up to 500 MB