Device attributes in a SAML assertion become policy context inside the Zero Trust Exchange. Zscaler consumes those attributes as part of identity and session context so downstream ZIA or ZPA policies can evaluate device state during access decisions. Option D (Zero Trust Exchange) is correct because the Zero Trust Exchange is the policy-enforcement fabric that uses those attributes.
Why the other options are incorrect:
A). Enforcement node: An enforcement node applies decisions to traffic. The attributes must first be consumed and normalized by the Zero Trust Exchange policy context.
B). Zscaler SAML SP: SAML provides browser-based federation by carrying signed assertions from the identity provider to the service provider.
C). Mobile Admin Portal: Mobile Admin Portal/Client Connector administration is for endpoint-agent configuration, not the identity-policy component in the stem.

When SSL Inspection policy bypasses a transaction, Zscaler does not decrypt and re-sign the session. Instead, the proxy passes the TLS connection through so the browser receives the real origin-server certificate. This behavior is used for pinned applications, privacy categories, and traffic that should not be decrypted. Option C (When traffic is exempted in SSL Inspection policy rules) is correct because bypassed SSL Inspection rules preserve the server certificate in the user's browser session.
Why the other options are incorrect:
A). When traffic contains a known threat signature: Threat signatures trigger security handling such as blocking or inspection. Passing the real server certificate happens when SSL inspection is bypassed.
B). When web traffic is on custom TCP ports: Custom TCP ports affect traffic handling and forwarding.
They do not automatically make Zscaler present the real origin certificate to the browser.
D). When user has connected to server in the past: Past connection history does not decide certificate presentation. The SSL Inspection policy action for the current transaction does.