Option D provides direct administrative evidence rather than an inference from user traffic. Zscaler's ZPA Audit Logs documentation states that audit logs display administrator sign-in and sign-out attempts, actions, request IDs, and completed configuration changes. Those records establish who performed an entitlement- related action, when it occurred, and what operation was attempted or completed. The relevant audit entry should be validated first and then correlated with identity, endpoint, and security events in the SIEM using its timestamp and request or transaction identifiers. DLP dashboards describe sensitive-data events; Firewall Insights describes network sessions and policy activity; and Web Insights describes web transactions. None is authoritative for attributing an administrator's configuration change. Audit logs therefore supply the defensible source record before broader SIEM correlation.

XSS protection addresses malicious browser-side script behavior, including attempts to steal cookies or send potentially malicious requests through a trusted site context. These attacks exploit the browser's trust in a legitimate application and can expose sessions or user data. Option C (Cookie Stealing and Potentially Malicious Requests) is correct because cookie stealing and potentially malicious requests are XSS exploit outcomes.
Why the other options are incorrect:
A). Security Exceptions and Malicious Active Content Protection: Malicious active content means scripts, applets, or browser-executed objects that can exploit or manipulate a user session.
B). File Format Vulnerabilities and Browser Exploits: File-format vulnerabilities and browser exploits are broader exploit categories. XSS specifically abuses script execution in a trusted web context.
D). Cookie Stealing and Advanced Threats Policy: Cookie stealing is an XSS outcome, but "Advanced Threats Policy" is a policy family, not the second XSS exploit type in the answer.

Multiple distributed DNS resolvers providing local resultsconnect Zscaler users to the nearest Microsoft
365 servers. This approach ensures users get localized DNS resolution, which directs them to the closest Microsoft 365 endpoint, improving performance and reducing latency.
The study guide highlights the importance of distributed DNS resolution in optimizing cloud application performance for users.

Option C expresses both business intent and security boundaries with explicit, ordered File Type Control rules. The narrow allow rule permits contractor uploads of archives only to the approved code repository. The broader rule then blocks archives and executables when the same group uses generic file-sharing applications.
Placing the specific allow above the block prevents the general rule from denying the authorized workflow.
Zscaler's File Type Control overview supports policy criteria such as users, groups, applications, and file types. The File Type Control troubleshooting runbook explains that ZIA identifies actual file types using file signatures, rather than trusting extensions, which addresses renamed executables. A single enterprise block is unnecessarily broad. Out-of-band scanning is not a substitute for upload enforcement, and URL Filtering alone cannot reliably distinguish allowed archives from disguised executable content.

Zscaler PageRisk, specifically the Page Risk Index, is the proprietary scoring capability used in ZIA to evaluate the risk of web pages dynamically. Instead of relying only on static URL blocklists, PageRisk uses a multi-data algorithm that considers page content and domain characteristics. Page-content signals include risky scripts, suspicious iFrames, XSS indicators, vulnerable controls, and other active content. Domain signals include reputation, hosting location, age, and relationships to risky top-level domains. The verified answer is Option B (Zscaler PageRisk) because PageRisk is the Zscaler technology used for real-time website risk scoring.
Why the other options are incorrect:
A). Third-Party Sandbox: A sandbox detonates files to observe malicious behavior. PageRisk is a web-page
/domain scoring engine, and Zscaler uses native sandboxing rather than a third-party PageRisk service.
C). Browser Isolation Feedback Form: Browser Isolation renders risky pages remotely to protect the endpoint. A feedback form would collect input; it would not calculate real-time web risk.
D). Deception Controller: The Deception controller manages decoys, lures, and honeytokens for intruder detection. It is about lateral-movement detection, not public website scoring.