For rapid root-cause isolation, ZDX Analyze Score with the Y-Engine is the right diagnostic path. It correlates endpoint, network, Zscaler path, and application metrics so the administrator does not have to manually interpret packet captures or guess whether AWS, Wi-Fi, ISP, or device health is responsible. Option B (Check the user ' s ZDX score for a period of low score for AWS and use Analyze Score to get the ZDX Y-Engine analysis) is correct because it gives the fastest useful root-cause analysis from the user ' s ZDX score.
Why the other options are incorrect:
A). Check the Zscaler Trust page for any indications of cloud outages or incidents that would be causing a slowdown: The Zscaler Trust page reports cloud service incidents, but it will not isolate one user's endpoint, Wi-Fi, ISP, or AWS path issue.
C). Do a Deep Trace on the user ' s traffic and check for excessive DNS resolution times and other slowdowns:
DNS resolves names to IP addresses; it is a support service, not an access protocol or scoring engine by itself.
D). Initiate a packet capture from Zscaler Client Connector and escalate the case to have the trace analyzed for root cause: Zscaler Client Connector is the endpoint agent that steers traffic, authenticates users, reports posture, and supplies ZDX telemetry.

Yes, theAccess Control suite includes controls for segmentation and conditional access, which are designed to prevent lateral movement within networks. These features allow organizations to restrict access between different segments and enforce policies that limit the spread of threats or unauthorized access within internal environments.

Z-Tunnel 2.0 extends forwarding beyond web proxy traffic by securing all IP unicast traffic through DTLS
/TLS tunnels to the Zero Trust Exchange. This enables Cloud Firewall and other controls to inspect all TCP and UDP ports, and ICMP where supported, rather than only browser HTTP/HTTPS flows. Option C (All TCP and UDP ports as well as ICMP traffic) is correct because Tunnel 2.0 is the all-ports-and-protocols forwarding model for Client Connector.
Why the other options are incorrect:
A). TCP ports 80, 443 and 8080 only: Ports 80, 443, and 8080 describe common web proxy traffic. Tunnel
2.0 forwards broader IP traffic, including TCP, UDP, and ICMP.
B). Any HTTP/HTTPS traffic as well as DNS: DNS resolves names to IP addresses; it is a support service, not an access protocol or scoring engine by itself.
D). All Web ports as well as FTP and SSH: RDP, SSH, and VNC are privileged remote access protocols for desktop, shell, and graphical administration.

Option C implements the privacy exception in the policy that controls decryption. Zscaler's SSL/TLS Inspection configuration guidance allows rules to use URL Categories as criteria and apply the appropriate inspection action. Zscaler's rollout best practices specifically note that organizations may bypass the Finance and Health categories because of privacy concerns. A narrowly scoped Do Not Inspect rule for those categories should precede the broader inspection rule, allowing other eligible traffic to remain decrypted and inspected. DLP operates after content becomes visible and therefore cannot satisfy a prohibition on decryption. Root-CA distribution enables trusted interception but does not create a privacy exemption. Out-of- band CASB examines stored SaaS data and does not control the inline TLS session. The exception should also be documented, approved, and periodically reviewed.

Custom DLP dictionaries let administrators define the exact business-specific content that should be treated as sensitive. They can include keywords, phrases, patterns, and regex expressions that match regulated data, internal identifiers, or proprietary terms. Option A (Define specific keywords, phrases, or patterns relevant to their organization's sensitive data policy) is correct because those dictionary entries are what Zscaler uses to detect data in motion.
Why the other options are incorrect:
B). Define specific governance and regulations relevant to their organization's sensitive data policy:
Governance and regulatory labels help describe policy intent. A custom dictionary needs the actual sensitive- data tokens: keywords, phrases, or patterns.
C). Define specific SaaS tenant relevant to their organization's sensitive data policy: A SaaS tenant value controls which tenant or instance users may access. Custom dictionaries define content patterns, not tenant boundaries.
D). Define specific file types relevant to their organization's sensitive data policy: File type definitions classify files such as executables or archives. Custom DLP dictionaries define sensitive words, phrases, regexes, or identifiers.