Zscaler's out#of#band CASB solution supports data#at#rest protection for cloud storage platforms like Google Drive, enabling scanning and governance of files stored there.

Trusted Network Detection in Zscaler Client Connector can reference DNS Search Domains, DNS Server IPs, and Hostname Resolution (i.e. a hostname and the IP it resolves to) as criteria for determining a trusted network.

Network Applications are enforced by Firewall Filtering because they are identified at the network
/application layer rather than as web pages or DLP events. When access to a Network Application is blocked, the administrator should look at firewall policy and firewall logs for the matching rule. Option C (Firewall Filtering) is correct because Firewall Filtering controls network application access.
Why the other options are incorrect:
A). Sandbox: Cloud Sandbox detonates and observes suspicious files to identify unknown or advanced malware behavior.
B). Browser Control: Browser Control manages browser or web-session behavior. The question is about data protection/control, not browser management.
D). DLP: DLP detects and controls sensitive data movement. The question's correct feature is more specific than the broad DLP label.

When migrating from an on-premises proxy to Tunnel Mode, leaving legacy browser or system proxy settings in place can create loops or conflicting forwarding paths. Best practice is to enforce no proxy configuration so Client Connector owns traffic steering cleanly through the configured tunnel. Option B (Enforce no Proxy Configuration) is correct because Tunnel Mode should not depend on legacy proxy auto-configuration.
Why the other options are incorrect:
A). Execute a GPO update to retrieve the proxy settings from AD: A GPO can push Windows settings, but using it to reapply old proxy configuration works against Tunnel Mode best practice.
C). Use Web Proxy Auto Discovery (WPAD) to auto-configure the proxy: WPAD auto-discovers proxy settings; it can accidentally preserve legacy proxy behavior during a tunnel-mode migration.
D). Use an automatic configuration script (forwarding PAC file): A PAC file tells the client or browser which proxy path to use for matching destinations.

Option D covers cloud-resident content even when the original transaction did not traverse the inline proxy.
Zscaler's out-of-band CASB uses SaaS-provider API integrations to scan data at rest with DLP engines, identify sensitive content, inspect sharing exposure, and support remediation of risky external shares. Zscaler' s Data at Rest Scanning DLP configuration guide places this capability under Out-of-Band CASB. Its CASB overview explains that API-based scanning discovers sensitive SaaS content and that collaboration management can revoke risky sharing. Browser Isolation affects future interactive sessions but does not inventory existing SaaS data. Endpoint posture confirms device compliance rather than classifying tenant content or permissions. DNS analysis addresses command channels and suspicious resolution, not whether sanctioned SaaS files contain regulated data or are shared externally.