URL Filtering can send traffic to Browser Isolation only when the policy can determine that the user's browser is supported for isolation handling. The User Agent field provides that browser and client context, so it must be defined for Browser Isolation behavior to work correctly in the URL Filtering rule. Option B (User Agent) is correct because User Agent is the required field for applying the isolation action.
Why the other options are incorrect:
A). Groups: Groups target which users the URL rule applies to. Browser Isolation still needs User Agent so Zscaler can determine browser support/handling.
C). Departments: Departments are user attributes for rule targeting. They do not tell Zscaler whether the browser session can be isolated.
D). Device Trust: Device Trust is a posture/context signal. Browser Isolation depends on User Agent information for browser-specific handling.

Inline Data Protection is the process of inspecting data as it transits the network in real time, enforcing policies that prevent sensitive data from being leaked or transmitted improperly. Blocking the attachment of a sensitive document in webmail represents inline data protection because it intercepts and controls data transmission at the network level, stopping sensitive content before it leaves the organization.
Preventing copying to a USB drive is endpoint control and does not happen inline in network traffic.
Preventing sharing in OneDrive is cloud access security broker (CASB) activity, often done through API integrations, not inline network control. Analyzing M365 tenant security is an audit or advisory activity, not real-time inline protection.
Therefore, the correct example of inline data protection in Zscaler's cloud security services is blocking the attachment of a sensitive document in webmail.

Option A applies least privilege separately to internet/SaaS traffic and private applications. URL Filtering and Cloud App Control provide granular outbound policy by destination, application, user, and action. For private access, ZPA grants access to authorized applications rather than extending the user onto the network. Its inside-out App Connector model keeps applications undiscoverable from the internet and reduces exposure to lateral movement. The ZPA data sheet describes application segmentation, inside-out connectivity, and attack- surface reduction, while Zscaler's Access Policy documentation explains policy-based application access.
VLANs, shared subnets, traditional firewalls, and VPN ACLs remain network-centric and can preserve implicit reachability. TLS inspection is an important security control, but expanding decryption alone does not create least-privileged private-application authorization or eliminate network exposure.

App Connectors should be deployed in redundant pairs for each environment that hosts private applications. A single connector creates an availability risk because ZPA depends on connectors to provide outbound-only reachability to application servers. For four data centers, minimum resilient design means two connectors per data center. That is why Option B (Eight -two per data center) is correct: four data centers multiplied by two connectors per data center equals eight App Connectors.
Why the other options are incorrect:
A). Six - one per data center plus two for cold standby: Cold standby connectors sit idle until needed. ZPA resiliency normally depends on active redundant connectors per hosting location, not a few passive spares.
C). Four - one per data center: One connector per data center leaves that site with a single connector failure point. A maintenance event or connector outage would interrupt private-app access for that data center.
D). Sixteen - to support a full mesh to the other data centers: A full mesh is a network-topology mindset.
ZPA App Connectors do not need connector-to-connector mesh links; they need redundant outbound reachability to the Zscaler cloud.

When SSL Inspection is enabled and a user accesses a private application through Zscaler, the user will see a Zscaler generated MITM (Man-In-The-Middle) Certificateon their browser session. Zscaler intercepts and decrypts SSL/TLS traffic at the Service Edge and then re-encrypts it before forwarding it to the client, presenting its own certificate to maintain the security of the connection while enabling inspection.
This allows Zscaler to inspect encrypted traffic for threats and policy enforcement transparently without exposing the original server's certificate. The study guide clarifies this mechanism under SSL Inspection details.