In ZPA, Server Groups define which App Connector Groups can reach the application servers behind an Application Segment. They are part of the mapping that lets ZPA choose the correct outbound connector path for private application traffic. Option C (Maps App Connector Groups to Application Segments) is correct because Server Groups map App Connector Groups to Application Segments for reachability and steering.
Why the other options are incorrect:
A). Maps FQDNs to IP Addresses: DNS resolves names to IP addresses; it is a support service, not an access protocol or scoring engine by itself.
B). Maps Applications to FQDNs: DNS resolves names to IP addresses; it is a support service, not an access protocol or scoring engine by itself.
D). Maps Applications to Application Groups: Mapping applications to application groups is a policy- organization task. Server Groups specifically map reachable application servers to App Connector Groups.

ZPA grants access only after the request satisfies the authorization and security conditions in policy. This is core Zero Trust behavior: identity is verified, context is checked, device posture may be evaluated, and least- privilege rules determine whether a segmented private app is reachable. Option A (After passing criteria checks related to authorization and security) is correct because access is conditional on passing the defined criteria, not on merely initiating a connection.
Why the other options are incorrect:
B). Immediately upon connection request for best performance: Immediate access would skip the Zero Trust decision. ZPA first checks identity, context, posture, and policy before creating the private-app connection.
C). After a short delay of a random number of seconds: Random delay is not a security control in ZPA.
Access is granted or denied predictably after the rule conditions are evaluated.
D). After verifying the user password inside of private application: The private application may still have its own login, but ZPA conditional access is decided before the user reaches that app. ZPA is the access broker, not the application password checker.

Exact Data Match protects structured sensitive data by converting source values into secure hashes before they are used by Zscaler cloud enforcement. The on-premises EDM VM performs indexing locally so raw customer data is not uploaded into the Zscaler cloud. Only hashed values are used for matching. Option B (By using an on-premises VM to index data and only sending hashed values to the cloud) is correct because the VM automates indexing and sends hashed data, not clear sensitive records, to the cloud.
Why the other options are incorrect:
A). By storing sensitive structured data on servers managed by trusted Zscaler staff for enhanced security:
Storing raw structured data on Zscaler-managed servers would create unnecessary exposure. EDM avoids this by sending hashed values, not the original data.
C). By requiring customers to manually hash the data and upload it to the cloud: Manual customer hashing is error-prone and not the EDM workflow. The on-premises VM automates hashing/indexing before values are sent to Zscaler.
D). By encrypting sensitive data directly before storing it in the cloud: Encrypting raw sensitive data before cloud storage still implies the data is being stored. EDM avoids that by sending hashes, not the original structured values.

Exact Data Match protects structured sensitive data by converting source values into secure hashes before they are used by Zscaler cloud enforcement. The on-premises EDM VM performs indexing locally so raw customer data is not uploaded into the Zscaler cloud. Only hashed values are used for matching. Option B (By using an on-premises VM to index data and only sending hashed values to the cloud) is correct because the VM automates indexing and sends hashed data, not clear sensitive records, to the cloud.
Why the other options are incorrect:
A). By storing sensitive structured data on servers managed by trusted Zscaler staff for enhanced security: Storing raw structured data on Zscaler-managed servers would create unnecessary exposure. EDM avoids this by sending hashed values, not the original data.
C). By requiring customers to manually hash the data and upload it to the cloud: Manual customer hashing is error-prone and not the EDM workflow. The on-premises VM automates hashing/indexing before values are sent to Zscaler.
D). By encrypting sensitive data directly before storing it in the cloud: Encrypting raw sensitive data before cloud storage still implies the data is being stored. EDM avoids that by sending hashes, not the original structured values.

Prevent Compromise analyzes device and network telemetry - including security configurations, event logs, and traffic flows - to gauge how well you're blocking initial intrusion attempts and misconfigurations.