ZPA App Connectors are the outbound-only brokers that make private applications reachable through the Zero Trust Exchange. For resiliency, Zscaler recommends at least two App Connectors so traffic can continue if one connector is unavailable, being upgraded, or overloaded. Option A (2) is correct because a two- connector minimum provides the basic high-availability pattern for private application access.
Why the other options are incorrect:
B). 6: Six connectors would be more than the minimum for a single resilient ZPA deployment. The exam asks for the recommended minimum, and two connectors provide the basic active redundancy pattern.
C). 4: Four connectors can be a valid larger design for capacity or multiple sites. It is not the minimum number needed to avoid a single connector failure.
D). 3: Three connectors can add extra capacity, but Zscaler's basic resiliency recommendation starts with a pair, not an odd three-connector minimum.

Option A addresses the precise risk: an encrypted, password-protected file cannot be fully inspected or detonated inline, so it must not be treated as known safe. ZIA can apply a File Type Control action to unscannable files, allowing the organization to block the download according to its risk policy rather than permitting content that malware engines cannot examine. Zscaler's malware-protection security-exception guidance identifies allow or block handling for files that cannot be scanned, and its policy-reason reference includes unscannable-file outcomes. Lowering DLP thresholds targets data-loss detection and would create unrelated false positives. Tenant-wide restrictions are disproportionate to a single encrypted download. API scanning can complement inline inspection for sanctioned SaaS data, but disabling inline control would remove protection at the moment of access and would not make the encrypted file inspectable.

Z-Tunnel 2.0 extends forwarding beyond web proxy traffic by securing all IP unicast traffic through DTLS
/TLS tunnels to the Zero Trust Exchange. This enables Cloud Firewall and other controls to inspect all TCP and UDP ports, and ICMP where supported, rather than only browser HTTP/HTTPS flows. Option C (Zscaler Client Connector will encapsulate the user ' s traffic in DTLS/TLS tunnels to the ZTE) is correct because Tunnel 2.0 is the all-ports-and-protocols forwarding model for Client Connector.
Why the other options are incorrect:
A). Zscaler Client Connector will encapsulate the user ' s traffic in GRE tunnels to the ZTE: Zscaler Client Connector is the endpoint agent that steers traffic, authenticates users, reports posture, and supplies ZDX telemetry.
B). Zscaler Client Connector will encapsulate the user ' s traffic in IPSec tunnels to the ZTE: IPS inspects traffic inline for exploit signatures and attack patterns, then blocks or resets offending sessions.
D). Zscaler Client Connector will encapsulate the user ' s traffic in HTTP Connect tunnels to the ZTE: Zscaler Client Connector is the endpoint agent that steers traffic, authenticates users, reports posture, and supplies ZDX telemetry.

In SaaS Security API DLP policies you can choose "Remove External Collaborators and Shareable Link" as the enforcement action - Zscaler will report the incident, revoke any external collaborators on the file, and delete its external share links.

Comprehensive and Detailed 100 to 150 words of Explanation From Zscaler Digital Transformation Administrator topics:
ZPA Browser Access provides clientless access to supported private web applications, so D is correct. It allows an authorized user to open an application from a standard web browser without installing Zscaler Client Connector, a dedicated browser extension, or special browser configuration. Authentication and ZPA access policy still apply, which makes C incorrect because Browser Access does not provide anonymous access. Option A incorrectly requires Client Connector, while B incorrectly requires a plug-in and managed browser changes. This capability is particularly useful for contractors, unmanaged devices, partners, or short- term access scenarios in which deploying an endpoint agent is impractical. Access remains application- specific rather than providing network-level connectivity. Zscaler's official Browser Access overview states that applications can be made available through any browser without Client Connector, browser plug-ins, or additional configuration.