When using a Domain Joined posture element to allow access in a ZPA Access Policy, which statement is true?

The Domain Joined posture element in ZPA evaluates whether a device belongs to a specific Active

Directory domain. ZPA performs this evaluation using the device’s local posture signals, either

through the Zscaler Client Connector posture engine or through the browser-based posture

evaluation framework used in ZPA Browser Access. When a user connects via Browser Access, ZPA

can still determine domain membership by inspecting the allowed browser posture attributes

provided by the endpoint, enabling device-based Zero Trust controls without requiring a full Client

Connector installation.

Linux endpoints do not support domain-joined posture verification, making option A incorrect.

Domain join validation is performed at the device level, not through the Identity Provider, because

IdPs validate users, not device domain status, eliminating option D. ZPA’s posture configuration

allows you to define multiple domains within a single posture profile, so creating a second posture

profile is unnecessary, making option C incorrect.

Therefore, the correct statement is that ZPA Browser Access can determine whether the device is

joined to the specified domain, which aligns with the expected behavior of the domain-joined

posture element.