Zscaler ships a set of Alert Rules curated and maintained by its ThreatLabZ research team, and administrators can also build their own custom (customer#defined) rules to meet specific organizational needs.

Answer B is correct. A Trusted Network bypass can send matching traffic directly instead of forwarding it through the Zscaler enforcement path. If the collaboration suite's domains remain inside that bypass, the departmental permit does not guarantee that category controls or inspection will be applied. The administrator should narrow the bypass so those domains are excluded from direct handling and are forwarded through the profile to ZIA or the appropriate Zscaler service. This preserves the trusted-network behavior for destinations that genuinely require it while restoring inspection for the new suite. Moving the departmental rule does not change traffic that never reaches the policy engine, and firewall defaults cannot substitute for Zscaler inspection. Deferring enforcement off-network also leaves an acknowledged on-network gap. See Zscaler's Forwarding Profile configuration and traffic-forwarding best practices.

Inline Data Protection means Zscaler is inspecting data while it is actively moving through an inline traffic path, not after the file is already stored or copied locally. In ZIA, inline DLP evaluates web, SaaS, and webmail uploads in real time by using DLP engines, dictionaries, EDM/IDM, OCR, and other content- inspection logic. That is why Option D (Blocking the attachment of a sensitive document in webmail) is the verified answer: the sensitive document is attached to webmail and Zscaler can stop that outbound transaction before the content leaves the organization.
Why the other options are incorrect:
A). Preventing the copying of a sensitive document to a USB drive: USB-drive blocking is endpoint/data-in- use protection. It stops a local copy action, while inline DLP stops sensitive content as it moves through ZIA traffic.
B). Preventing the sharing of a sensitive document in OneDrive: OneDrive sharing control is normally SaaS API/CASB enforcement against a file already stored in OneDrive. The webmail attachment case is live data-in-motion inspection.
C). Analyzing a customer's M365 tenant for security best practices: M365 tenant analysis checks configuration posture, permissions, and risky settings. It gives visibility and recommendations; it does not block a user upload in real time.

Users receive conditional access only once they satisfy the policy's authorization and security criteria, ensuring device posture, user identity, and any other checks have passed before they can reach the segmented application.

At launch, Zscaler Client Connector must determine which tenant and identity flow apply to the user ' s domain. The Zscaler Central Authority provides this discovery information so the client can direct authentication to the correct IdP and service cloud. Option B (Zscaler Central Authority) is correct because Central Authority is the initial lookup point for domain and IdP context.
Why the other options are incorrect:
A). Zscaler Private Access (ZPA) Portal: The ZPA portal manages private access configuration. At launch, Client Connector first needs cloud/domain discovery, which is handled through Central Authority.
C). Zscaler Internet Access (ZIA) Portal: The ZIA portal manages Internet Access policy after tenant selection.
It is not the first discovery service that maps the user domain to the correct IdP.
D). Zscaler Client Connector Portal: Zscaler Client Connector is the endpoint agent that steers traffic, authenticates users, reports posture, and supplies ZDX telemetry.