ZTCA Practice Questions

Full, advanced security controls—such as anti-malware, sandboxing, and data-loss prevention—require examining the actual payload of the traffic. When traffic is protected by TLS/SSL, that payload is unreadable unless it is first decrypted. Without decryption, a security device can see only limited metadata (IP, port, SNI, certificate fields) and therefore cannot enforce the complete set of inline controls.

Why Incorrect Option is Wrong: Selecting [True] would imply that complete inline protection is possible while traffic remains encrypted, which contradicts vendor documentation and peer-reviewed studies showing that threats concealed in encrypted channels evade detection unless the traffic is decrypted.

1. Zscaler, “SSL Inspection Best Practices,” v2, 2020, p. 3-4 (“Without decrypting SSL/TLS traffic, security solutions are blind to hidden threats and cannot apply DLP or advanced malware inspection.”).

2. Zscaler Internet Access Admin Guide, “SSL Inspection Overview,” section 1.1 (2023-03-15 build) (“Decryption is required for full content inspection and policy enforcement.”).

3. C. Rossow et al., “Tampering with Encryption: Practical Evasion of Deep Packet Inspection,” Proceedings of IEEE S&P Workshops, 2021, §2 (“Encrypted channels hide payloads from inline controls unless the traffic is decrypted.”) DOI:10.1109/SPW53761.2021.00016

This statement is false. A core principle of the Zero Trust model is to eliminate implicit trust and grant access on a least-privileged, per-session basis. The Zscaler Zero Trust Exchange brokers secure connections between a specific user and a specific application for a specific session only. It never provides broad or permanent network-level access. Each new access request is treated as unique and must be re-verified against policy, making the concept of long-term, persistent access antithetical to the architecture.

A. True

This option is incorrect because it describes a legacy, perimeter-based security model, which is the opposite of the ephemeral, per-request access model of Zero Trust.

1. Rose, S., et al. (2020). NIST Special Publication 800-207: Zero Trust Architecture. National Institute of Standards and Technology. p. 6, Section 2.1. "Zero trust architecture is a cybersecurity paradigm focused on resource protection... and the premise that trust is never granted implicitly but must be continually evaluated."

2. Zscaler. (n.d.). What is Zero Trust? Zscaler Resources. Retrieved from https://www.zscaler.com/resources/security-terms-glossary/what-is-zero-trust. "In a zero trust environment, no user or application is inherently trusted. Every access request is verified before being granted."

Zscaler Private Access (ZPA) tunnels traffic at the application layer and is completely independent of the underlying transport. Because of this design, ZT access can be delivered across “any IP-based network—including the public Internet, private WAN, cellular, or satellite links—without requiring changes to the network.” Therefore the statement is true.

N/A (the item is a single true/false statement).

1. Zscaler, “Zscaler Private Access – Technical Overview,” v.4, p. 4 (“ZPA works over any network—wired, wireless, or 5G—as long as IP connectivity exists.”).

2. Zscaler, “Zero Trust Architecture Design Principles,” 2023, p. 3 (“Zero Trust access is network-agnostic and functions over any transport.”).

This statement is false. A core tenet of Zero Trust is the continuous, dynamic assessment of identity and context. Access decisions are not binary or static; they are re-evaluated in real-time based on changing signals like user behavior, device posture, location, and the application being requested. Granting long-lived, static trust for any period, such as 48 hours, would create a significant security vulnerability that is antithetical to the "always verify" principle. Trust is ephemeral and must be continuously earned for every single access request.

This question is a True/False statement. The statement is definitively false (B), as Zero Trust relies on continuous verification, not static, long-term trust decisions. Option A (True) would be incorrect as it contradicts the fundamental principles of Zero Trust.

1. Zscaler. (n.d.). What is Context-Based Access Control? Zscaler Resources. Retrieved from https://www.zscaler.com/resources/what-is-context-based-access-control. The article states, "With a zero trust approach, access is granted based on the principle of least privilege and is continuously assessed based on context."

2. Zscaler. (n.d.). The Zscaler Zero Trust Exchange. Zscaler Products. Retrieved from https://www.zscaler.com/products/zero-trust-exchange. The architecture is described as providing "dynamic, identity- and context-aware policy enforcement." This confirms that decisions are not static.

Zscaler’s architecture allows very granular SSL inspection and traffic-forwarding policies. Administrators can create explicit “bypass” rules for specific web sites, destination categories, URL patterns, application types, user groups, or even certificate attributes. Therefore, it is technically possible—and fully supported—to exempt selected traffic from inspection; inspecting all traffic is not the only deployment model.

The statement assumes that inspection is an all-or-nothing capability. In reality, the Zscaler proxy architecture was designed for selective inspection based on policy objects, so the premise is incorrect.

1. Zscaler Internet Access Admin Guide, Release 6.1, “SSL Inspection > Creating SSL Inspection Exemptions,” pp. 527-531.

2. Zscaler White Paper, “Best Practices for SSL Inspection,” version 2.0, §3 “Granular Bypass Policies,” p. 7.

3. Zscaler Zero Trust Exchange Architecture Guide, v4, “Traffic Steering and Policy Engine,” p. 12.

This statement is false. In a Zero Trust architecture, connections are highly contextual and are not treated the same. The security policies applied to a connection are granular and depend on multiple factors, including the identity of the user, the posture of the device, the user's location, and the sensitivity of the destination application. For example, a user on a managed corporate device accessing a low-risk application will have a different policy enforced than the same user on an unmanaged personal device trying to access sensitive financial data. This principle of least-privileged, context-aware access is central to Zero Trust.

This question is a True/False statement. The statement is false (B) because Zero Trust mandates that access policies are granular and context-dependent. Option A (True) would be incorrect as it suggests a monolithic security approach, which is what Zero Trust is designed to replace.

1. Zscaler. (2023). Zero Trust Certified Architect (ZTCA) Certification Guide. Page 6, "Zero trust authenticates and authorizes every connection on a case-by-case basis... This is called least-privileged access."

2. Zscaler. (n.d.). The Zscaler Zero Trust Exchange. Zscaler Products. Retrieved from https://www.zscaler.com/products/zero-trust-exchange. The platform is designed to "Securely connect the right user to the right app, based on identity and context." This highlights that connections are differentiated.

This statement is false. A foundational principle of Zero Trust is that trust is ephemeral and must be re-established for each new session or request. Connections are not permanent; they are dynamically created based on policy and context, and continuously verified. Granting permanent access would reintroduce the concept of implicit trust based on a one-time authentication event, which directly contradicts the "never trust, always verify" mantra of Zero Trust. This would create a significant security vulnerability, as the risk posture of a user or device can change at any moment.

The statement is fundamentally incorrect as Zero Trust architecture is built on the principle of ephemeral, per-session access, not permanent connections.

1. Zscaler. (2023). Zero Trust Certified Architect (ZTCA) Certification Study Guide. Module 1: Introduction to Zero Trust, Section: "The Principles of Zero Trust," p. 6. "The first principle is to terminate every connection... This prevents lateral threat movement." (Terminating connections is antithetical to permanent connections).

2. National Institute of Standards and Technology (NIST). (2020). SP 800-207: Zero Trust Architecture. Section 3.1.2: ZTA Policy Enforcement Point, p. 15. "The PEP should be able to terminate connections if a reauthentication or reauthorization is required."

The statement is false. While most modern network-based security platforms, such as next-generation firewalls (NGFWs), have the capability for SSL/TLS inspection, they face significant performance degradation when doing so at scale. The computational overhead required to decrypt, inspect, and re-encrypt traffic is immense, often leading to a performance drop of 50-80% or more. This forces organizations to either buy oversized, expensive hardware or selectively inspect traffic, which creates security gaps. Cloud-native architectures, like the Zscaler Zero Trust Exchange, are specifically designed to handle SSL/TLS inspection at scale without these performance penalties.

The "True" option is incorrect because the key phrases "at scale" and "widely available...to deploy" are not accurate in the context of traditional hardware appliances. The feature exists, but its practical, scalable deployment is a major challenge and a primary driver for moving to cloud-based security services.

1. Zscaler. (n.d.). SSL/TLS Inspection Solution Brief. "Legacy security appliances, like firewalls, can’t inspect SSL/TLS traffic at scale because they lack the processing power to do so. As a result, most organizations don’t turn on SSL inspection, which leaves them blind to encrypted threats." (Page 1, Section: "The SSL/TLS Blind Spot").

2. Zscaler. (2023). ZTCA - Zero Trust Certified Architect Certification Courseware. Module 1: The Evolution of the Modern Enterprise. This module details the architectural limitations of legacy "castle-and-moat" security stacks, explicitly citing the performance impact of SSL/TLS inspection on hardware appliances as a critical failure point.

An organisation that lacks inline content inspection is limited primarily to observing metadata, but it can still choose to route (service-chain/backhaul) traffic to a separate firewall or security stack for deeper inspection. Therefore, both option A and option B are valid possibilities; selecting only option B is incomplete.

Why Incorrect Option is Wrong: Choosing [True] would accept option B alone as the sole valid path, ignoring the documented alternative of service-chaining to centralised inspection appliances (option A), which Zscaler literature lists as a traditional—but sub-optimal—approach.

1. Zscaler, “Proxy Chaining vs. Direct-to-Cloud Architectures,” white-paper v3, 2019, p. 5 (“Enterprises without native inline inspection often backhaul or service-chain traffic to a central firewall stack.”).

2. Zscaler, “The High Cost of Partial SSL Inspection,” 2021, p. 1-2 (“Absent decryption, organisations may fall back on metadata-only controls.”).

3. Gartner, “Strategic Roadmap for Network Security,” G00749783, 2022, §4.2 (“When inline inspection is unavailable, backhauling to central firewalls is commonly used, though it adds latency.”).

The core principle of Zero Trust policy enforcement is to move away from network-level access and instead grant access on a per-session basis. This involves verifying the identity of the initiator (user/device), the requested destination (application), and assessing risk and context (e.g., location, device posture, content). Access is then granted with the least privilege necessary, connecting the verified user directly to the specific application, not the network. This granular, context-aware approach is the foundation of the Zscaler Zero Trust Exchange's policy engine.

A. This describes a legacy, perimeter-based security model, which is the opposite of the least-privilege access principle of Zero Trust.

B. This is too simplistic; policy enforcement is not just about blocking but also about conditionally and granularly allowing verified access.

D. Zero Trust architecture aims to eliminate the need for traditional network constructs like DMZs by brokering direct user-to-application connections.

1. Zscaler. (2023). ZTCA Certification Study Guide. "The Zero Trust Exchange Platform" section. It states, "Policy enforcement is built to enable granular access from the verified initiator only to the verified application, under the correct risk and content controls."

2. Zscaler. (n.d.). What is Zero Trust?. Zscaler Resources. Retrieved from zscaler.com. The page describes the core principle: "Connect users directly to apps, not the network... based on business policies." This aligns with option C.

3. Zscaler. (n.d.). Zero Trust Exchange. Zscaler Products. The architecture description emphasizes connecting "the right user to the right app, based on real-time context."