Workflow Automation is used to notify users or teams when a DLP-related workflow needs attention. For end- user notification, enterprise collaboration tools such as Microsoft Teams and Slack are practical because they keep the message inside a controlled business channel. Option A (Notifications in MS Teams / Slack) is correct because Teams and Slack notifications are the supported user-notification path in this scenario.
Why the other options are incorrect:
B). SMS text message: SMS is a generic notification channel. Zscaler Workflow Automation for this use case sends collaboration notifications through tools like Teams or Slack.
C). Automated phone call: Automated phone calls are not the normal DLP workflow-notification method in this Zscaler scenario. The supported peer-collaboration channels are Teams and Slack.
D). Twitter post with custom hashtag: A Twitter/X post would be public and inappropriate for a DLP event.
Zscaler uses controlled enterprise notification channels, not social posting.

Zscaler Deception detects intruders by placing decoys, lures, and fake credentials inside the environment.
Legitimate users should not interact with those deceptive assets, so access attempts are high-confidence indicators of reconnaissance or lateral movement. Option B (Certificate Trust, File Path, Full Disk Encryption) is correct because Deception is the Zscaler capability built to detect intruders touching internal decoys.
Why the other options are incorrect:
A). Detect Crowdstrike, Crowdstrike ZTA score, First name: CrowdStrike checks can be posture signals when configured, but a user first name is an identity attribute, not device posture.
C). Domain Joined, Process Check, Deception Check: Deception uses decoys, fake credentials, lures, and traps to expose intruders who are exploring the environment.
D). Unauthorized Modification, OS Version, License Key: OS Version is a valid posture-style signal, but unrelated values like license key make that option invalid as a set.

With ZDX Advanced licensing, polling can be configured at a more aggressive interval for faster experience visibility. The minimum polling interval tested here is one minute, which supports quicker detection of experience degradation across monitored applications and users. Option A (1 minute) is correct because one minute is the minimum interval with ZDX Advanced.
Why the other options are incorrect:
B). 10 minutes: Ten minutes is a slower polling cadence than the minimum allowed with ZDX Advanced. The minimum polling interval is one minute.
C). 15 minutes: Fifteen minutes is too slow to be the minimum ZDX Advanced polling interval. ZDX Advanced can poll as frequently as one minute.
D). 5 minutes: Five minutes is a common probe interval in other ZDX contexts, but the minimum polling interval with ZDX Advanced is one minute.

For rapid root-cause isolation, ZDX Analyze Score with the Y-Engine is the right diagnostic path. It correlates endpoint, network, Zscaler path, and application metrics so the administrator does not have to manually interpret packet captures or guess whether AWS, Wi-Fi, ISP, or device health is responsible. Option B (Check the user's ZDX score for a period of low score for AWS and use Analyze Score to get the ZDX Y-Engine analysis) is correct because it gives the fastest useful root-cause analysis from the user's ZDX score.
Why the other options are incorrect:
A). Check the Zscaler Trust page for any indications of cloud outages or incidents that would be causing a slowdown: The Zscaler Trust page reports cloud service incidents, but it will not isolate one user's endpoint, Wi-Fi, ISP, or AWS path issue.
C). Do a Deep Trace on the user's traffic and check for excessive DNS resolution times and other slowdowns: DNS resolves names to IP addresses; it is a support service, not an access protocol or scoring engine by itself.
D). Initiate a packet capture from Zscaler Client Connector and escalate the case to have the trace analyzed for root cause: Zscaler Client Connector is the endpoint agent that steers traffic, authenticates users, reports posture, and supplies ZDX telemetry.

ZDX Score is a normalized digital-experience score used to represent how well a user or application is performing. It is expressed on a 1-to-100 scale, making degraded application, network, and endpoint experience easy to compare across users, locations, and time windows. Option A (1-100) is correct because 1-
100 is the ZDX scoring range.
Why the other options are incorrect:
B). 1-10: A 1-10 scale is too coarse for ZDX. ZDX uses a 1-100 score so administrators can see more granular experience changes.
C). 1 - 1000: A 1-1000 scale would imply excessive precision that ZDX does not present. The product score is the simpler 1-100 user-experience scale.
D). 0 - 50: A 0-50 range is not the ZDX scale. ZDX scores are represented on a 1-100 scale.