The correct answers are B and D . In Zero Trust architecture, risk is determined from multiple contextual signals , not from a single static attribute. Zscaler's architecture guidance states that policy decisions evaluate the user, machine, location, group, and more , which directly supports the use of device posture as a risk input. Device posture factors such as domain membership, certificate presence, endpoint protection tools like antivirus or endpoint detection and response (EDR), and disk encryption status are strong indicators of whether the device can be trusted for a given access request.
Behavioral patterns are also valid risk indicators. Zero Trust does not look only at who the user is; it also considers how that user and device are behaving over time. Repeated blocked malware downloads, blocked phishing attempts, and similar negative security events can indicate elevated risk and justify tighter policy enforcement on future requests. By contrast, the operating system alone is too narrow to be the best answer, and Layer 3 device API scanning is not the access-risk attribute model being tested here. Therefore, the strongest Zero Trust choices are device posture analysis and behavioral risk patterns .

The correct answer is D. Located anywhere and built on IPv4 or IPv6. In Zero Trust architecture, the network and application access model is not tied to a specific physical location, branch, or data center.
Zscaler's Zero Trust guidance emphasizes that users, devices, and applications can be securely connected in any location , which is a core shift away from legacy perimeter-based designs. The architecture is also described as IP independent , meaning policy and access decisions are not fundamentally anchored to traditional network constructs such as fixed addressing or trusted subnets. This is why Zero Trust can operate across modern environments regardless of where workloads reside.
The option about VPN concentrators is incorrect because VPN-based architecture is associated with legacy remote-access models that extend network trust and expose services differently from Zero Trust. In contrast, Zero Trust reduces implicit trust, avoids broad network-level access, and focuses on secure, application-aware connectivity. Therefore, the most complete and accurate answer is that a Zero Trust network can be located anywhere and built on IPv4 or IPv6 , rather than being limited to a legacy transport or perimeter model.

The correct answer is D . In Zero Trust architecture, policy enforcement is the specific control decision applied to a particular access request , based on the exact context of that request at that moment. Zscaler's architecture guidance emphasizes granular, context-based policies that control application access independently of IP address or location. It also explains that policy is determined by evaluating the user, device, location, group, and other factors, which means enforcement is transaction-specific rather than a broad network permission.
Option A refers to traditional AAA concepts and protocols, which may participate in identity workflows but do not define Zero Trust policy enforcement by themselves. Option B , SCIM with an Identity Provider (IdP), relates to identity provisioning rather than runtime enforcement. Option C reflects a legacy or infrastructure- centric design pattern, not Zero Trust. In contrast, Zero Trust enforcement is the actual outcome applied to that single request, such as allow, restrict, isolate, deceive, or block, depending on verified context. This is why the best answer is that policy enforcement is the unique and definitive implementation of control solely for that access request , not a generalized network-level permission model.

This statement is false . In Zscaler's Zero Trust architecture, the recommended design objective is to inspect as much encrypted traffic as possible because inspection enables security controls such as malware protection, sandboxing, intrusion prevention system (IPS), browser isolation, Data Loss Prevention (DLP), cloud application controls, tenancy restrictions, and file type controls. The reference architecture states that inspecting all TLS/SSL traffic provides the fullest visibility and strongest protection across the Zero Trust Exchange. However, the same document also clearly confirms that inspection bypasses are supported in specific circumstances . These documented exceptions include banking and finance destinations, healthcare destinations, business functions that require unencryptable traffic, certificate-pinned applications, and some Microsoft 365 application flows that may not function properly under inspection. Zscaler strongly recommends using bypasses only in extreme circumstances , but it does not say exceptions are architecturally impossible. Therefore, from a verified Zero Trust design standpoint, full inspection is the preferred security posture, while selective exceptions are still an allowed and documented deployment option.

The correct answer is A . In Zero Trust architecture, enforcement is not limited to a simple allow-or-block outcome. Zscaler's architecture model supports conditional access controls that let the user proceed while reducing exposure to risk. This is why controls such as isolation are important. Zscaler's TLS/SSL inspection reference architecture lists browser isolation among the protections enabled by traffic inspection, allowing access to proceed while isolating risky web activity from the endpoint. That matches the idea of allowing access without directly exposing the initiator to the destination's full risk.
The "steer" concept also fits Zero Trust control logic because traffic can be directed through the most appropriate enforcement path or protective service edge as part of policy execution. By contrast, physical quarantine is a coarse legacy-style response, time-based access does not directly reduce destination risk, and block would deny access entirely rather than allow it safely. In Zero Trust, the better outcome is to preserve business access while applying the right protective control. Therefore, the best answer is Conditionally allow with Isolate and, if needed, Steer .