Zscaler ZDTE Practice Test

ZDTE practice test: what's covered

• Platform Services & Forwarding
• Advanced ZIA Security
• ZPA Private Access
• Data Protection
• Management, Logging & ZDX

Free ZDTE sample questions

1. An engineer must forward all TCP and UDP traffic from managed laptops to the Zscaler cloud, not just web ports. Which Zscaler Client Connector tunnel mode meets this requirement?

   • A. Z-Tunnel 1.0, which forwards only HTTP and HTTPS traffic to the service edge
   • B. Tunnel with local proxy, which relies on the browser proxy settings only
   • C. None, because the platform requires a GRE tunnel for non-web protocols
   • D. Z-Tunnel 2.0, which forwards all ports and protocols through a DTLS or TLS tunnel
   Show answer

   Correct: D. Z-Tunnel 2.0 carries all ports and protocols so non-web applications are inspected, whereas Z-Tunnel 1.0 is limited to web traffic on the standard ports. Tunnel with local proxy is a legacy web-only mode, and GRE is a site forwarding method rather than something an endpoint agent uses.

2. A branch office with a static public IP must forward traffic to Zscaler without deploying agents to guest devices. Which forwarding method is most appropriate?

   • A. A PAC file distributed by email to each guest user before connecting
   • B. Source IP anchoring configured on the branch wireless controller
   • C. GRE tunnels from the branch router to the nearest Zscaler data centre
   • D. Zscaler Client Connector installed on every guest device at the branch
   Show answer

   Correct: C. GRE requires a static public address and forwards all traffic from the site regardless of device ownership, which is exactly the guest scenario. Installing agents on guest devices is not feasible, emailing PAC files is unenforceable, and source IP anchoring is a ZPA feature for preserving egress identity rather than a branch forwarding method.

3. An engineer is choosing between GRE and IPsec for a branch site. Select the TWO statements that correctly describe IPsec forwarding to Zscaler. (Choose TWO)

   • A. It provides higher per-tunnel throughput than GRE in all published configurations
   • B. It removes the need for any Zscaler location object to be configured
   • C. It supports sites with dynamic public IP addresses using a fully qualified domain name identity
   • D. It encrypts the traffic between the branch edge device and the Zscaler service edge
   • E. It requires a static public IP address at the branch in every deployment
   Show answer

   Correct: C and D. IPsec suits dynamic-address branches because the tunnel identity can be an FQDN rather than a fixed address, and it encrypts the transport unlike plain GRE. Static addressing is a GRE requirement rather than an IPsec one, IPsec tunnels typically have lower per-tunnel throughput than GRE, and a location object is still required for policy and reporting.

4. A company must exclude a payroll SaaS application from the Zscaler tunnel entirely because the provider blocks proxied connections. Which mechanism implements that exclusion for agent-based users?

   • A. A bypass entry in the app profile or forwarding profile PAC for that destination
   • B. A URL Filtering rule setting the payroll category action to allow
   • C. An SSL inspection exemption for the payroll application hostname
   • D. A firewall rule permitting the payroll destination on port 443
   Show answer

   Correct: A. Traffic must leave the tunnel entirely, which is a forwarding decision made by the client configuration rather than a policy decision inside the service. Allowing the category, exempting SSL inspection or permitting the port all still send the traffic through Zscaler, which is precisely what the provider rejects.

5. An engineer needs Zscaler policy to apply different rules to the Mumbai and Bengaluru offices, both forwarding by GRE. Which configuration element makes that distinction possible?

   • A. Separate SSL inspection profiles applied to each site's outbound traffic
   • B. Separate administrator accounts scoped to each office for policy edits
   • C. Separate NSS feeds configured for each site's traffic logs
   • D. Separate location objects, each bound to that site's tunnel and public address
   Show answer

   Correct: D. Location objects are the policy identity for site-forwarded traffic, so a distinct location per office allows differentiated rules, bandwidth control and reporting. Inspection profiles define how traffic is decrypted, administrator scoping controls who edits configuration, and NSS feeds export logs rather than differentiate policy.

Last updated: 2026-09-23

ZDTE practice test FAQ

Related practice tests

• Zscaler ZCC-ADMIN practice test
• Zscaler ZIA-SIM practice test
• Zscaler ZSS practice test
• Zscaler ZDTA practice test
• Zscaler ZDXA practice test
• Zscaler ZCCA-IA practice test