Which are valid criteria for use in Access Policy Rules for ZPA?

Zscaler Private Access (ZPA) allows administrators to create Access Policy rules based on multiple conditions to enforce zero-trust access control. Valid criteria for ZPA Access Policy rules include identity criteria such as SAML/SCIM group membership, risk-based posture criteria including ZIA User Risk Score, and endpoint device posture profile criteria such as Domain Joined status and Certificate Trust. Device posture checks verify whether the client endpoint meets specific security requirements before granting access to private applications. Combining group membership, device posture profiles, and risk scores ensures that access is granted dynamically based on user identity, context, and endpoint security hygiene. Therefore, Option A correctly lists valid criteria used in ZPA Access Policies.

Option B: Password is not evaluated as an access policy rule criterion directly within ZPA policy criteria, as authentication is delegated to the Identity Provider.

Option C: Time of Day and Country Code are criteria used in ZIA policy evaluation, not standard ZPA Access Policy rule conditions.

Option D: SNI (Server Name Indication) is a TLS header parameter rather than a valid ZPA Access Policy rule criterion.

- Zscaler Documentation: "Configuring Access Policies", ZPA Help Portal, 2023, Section: Policy Criteria.

- Zscaler Documentation: "Evaluating Device Posture Profiles", ZPA Help Portal, 2023, Section: Posture Types.