ZPA Access Policy rules use identity, user/group, device posture, and contextual signals to decide private- application access. Valid criteria are enforcement attributes that ZPA can evaluate, such as group membership, risk score, domain-joined state, and certificate trust. Option A (Group Membership, ZIA Risk Score, Domain Joined, Certificate Trust) is correct because all listed criteria are legitimate policy inputs for ZPA access decisions.
Why the other options are incorrect:
B). Username, Trusted Network Status, Password, Location: Trusted Network detection decides whether the device is on a known corporate network using signals such as DNS servers, search domains, gateways, or hostname resolution.
C). SCIM Group, Time of Day, Client Type, Country Code: SCIM provisions and synchronizes users, groups, and attributes between an identity provider and Zscaler.
D). Department, SNI, Branch Connector Group, Machine Group: Machine Group is used for machine identity grouping in some policy contexts, but it is not the same as the listed posture or access criteria set.