The correct answer is B . In Zero Trust architecture, risky behavior is controlled through continuous evaluation and policy-based response , not through static network constructs such as VLAN quarantine or dependence on standalone appliances. Zscaler's Zero Trust guidance emphasizes granular, context-based policies that evaluate the user, device, application, and surrounding conditions before and during access. In the ZPA architecture material, Zscaler states that applications should remain inaccessible unless the user is authorized, and policy should be independent of IP address or location.
The strongest architecture match is option B , because Zscaler documentation describes security outcomes such as inline prevention, deception, and threat isolation for compromised or risky users. That means when behavior becomes suspicious, later access attempts can be restricted, misdirected, or blocked based on updated policy context. This is fundamentally different from a legacy response such as placing a device permanently in a VLAN, which remains network-centric and coarse-grained. Logging alone also does not control risk, and simply deploying security appliances does not deliver Zero Trust by itself. Zero Trust controls risky behavior by dynamically adjusting enforcement based on observed context and threat posture, which best aligns with option B.

The correct answer is B. False . Zero Trust architecture does not treat identity and context as a one-time, fixed decision. Zscaler's architecture guidance shows that access is based on ongoing context , including user identity, device posture, location, and other factors that can change over time. For ZIA, policy assignment evaluates the user, device, location, group, and more to determine which policies apply. For ZPA, user access is matched against current conditions such as location, device posture, user group, department, and time of day .
Zscaler documentation also describes reauthentication intervals and session timeout controls, which further shows that identity and authorization are not treated as permanently settled after one decision. In addition, device posture checks can be repeated over time, and a failed posture check can cause a different policy to be applied.
This is fundamental to Zero Trust: trust is continually evaluated , not granted once and assumed valid for an arbitrary period such as 48 hours. Therefore, the statement is false because identity and access context must be revisited as conditions change.

The correct answer is B. In Zero Trust architecture, connection risk is informed by more than identity alone. It also depends on the security posture of the environment being accessed and the entitlements associated with cloud resources and users. Those signals are typically gathered through API-based integrations with cloud platforms and related systems, allowing the Zero Trust platform to evaluate posture and contextual risk before or during access decisions.
This fits the broader Zscaler architecture pattern, where policy and access decisions are driven by integrated context rather than fixed network assumptions. Zscaler documentation consistently shows that policy evaluation is based on multiple dynamic inputs and external integrations, including identity, device posture, and service context. API-driven connectivity is the practical method for collecting posture and entitlement information from major cloud providers at scale.
The other options do not fit this purpose. Automated DevOps pipelines may build or deploy resources, but they are not the primary mechanism for continuous posture and entitlement retrieval. Multi-factor authentication helps verify identity, not cloud posture. Premium subscriptions are commercial offerings, not a technical control. Therefore, the best answer is API integrations between the Zero Trust platform and major cloud providers.

The correct answer is C. Data Loss Prevention (out-of-band and inline). In Zero Trust architecture, protection of sensitive data such as Personally Identifiable Information (PII) is handled by controls that understand and govern the content being transmitted, not just the identity of the sender or the existence of a connection. Zscaler's TLS/SSL inspection reference architecture explicitly identifies Data Loss Prevention (DLP) as a capability that helps prevent sensitive data from leaving the organization . That directly addresses accidental broad sharing, because DLP policies can detect sensitive patterns and stop, restrict, or alert on improper distribution.
SSL/TLS inspection helps make the content visible, but by itself it is not the control that decides whether the sensitive information should be allowed. Identity verification is important for access decisions, but it does not prevent a legitimate user from unintentionally oversharing data. Virtual firewalls also do not provide content- aware protection for PII leakage. Zero Trust requires content-aware controls in addition to identity and context, which is why inline and out-of-band DLP is the correct answer for protecting accidentally shared PII.

The correct answer is B . If a security platform cannot perform inline content inspection , then it cannot fully inspect the payload of encrypted or application traffic. In practical terms, that means the enterprise is limited mainly to observing connection-level metadata such as source, destination, ports, categories, and other session attributes rather than the actual content moving through the session. Zscaler's TLS/SSL inspection reference architecture explains that when encrypted traffic is not decrypted, advanced analysis tools such as malware protection, sandboxing, and related controls cannot fully inspect that traffic. It also notes that traditional security appliances often handle only a small fraction of their normal traffic capacity when decryption is enabled, which is one reason many legacy environments inspect only a subset of traffic.
From a Zero Trust perspective, this limitation is significant because policy should be based not only on the existence of a connection, but also on what the connection is actually doing. Without inline inspection, hidden malware, risky transactions, and sensitive data loss can evade full control. Therefore, the realistic fallback is metadata visibility only, not full protection.