Strict Enforcement requires the installer to know both which Zscaler cloud to enroll against and which policy token authorizes the enforcement configuration. The cloudName parameter directs the client to the correct cloud, while policyToken applies the required strict-enforcement policy during enrollment. Option A (cloudName and policyToken) is correct because those two options are the required installer inputs.
Why the other options are incorrect:
B). userDomain and deviceToken: userDomain tells Client Connector the user login domain so it can route enrollment toward the right IdP.
C). cloudName and deviceToken: cloudName tells the installer which Zscaler cloud or tenant environment the client should use.
D). userDomain and policyToken: userDomain tells Client Connector the user login domain so it can route enrollment toward the right IdP.

Cloud Sandbox is built for unknown and suspicious files, especially when static signatures are not enough.
The file is detonated in an isolated environment so Zscaler can observe behavior and assign a verdict before allowing it to reach users. Option C (Identify Zero-Day Threats) is correct because sandboxing is most valuable for identifying zero-day threats and advanced malware behavior.
Why the other options are incorrect:
A). Block malware that we have previously identified: Known-malware blocking is signature/reputation enforcement. Cloud Sandbox adds value by analyzing unknown files before a known signature exists.
B). Build a test environment where we can evaluate the result of policies: A test environment for policy evaluation is a lab function. Cloud Sandbox is a malware detonation and behavior-analysis service.
D). Balance threat detection across customers around the world: Balancing detection across customers describes cloud-scale operations. Sandbox's student-level purpose is to detonate and classify suspicious files.

After ZIA validates the user's authentication, Client Connector provides the authentication token to the Client Connector Portal so the device can be registered. That registration ties the authenticated user, device, and enrollment state together for policy, posture, and service entitlement decisions. Option C (To enable the portal to register the user's device and pass the registration to Zscaler Internet Access) is correct because the token enables device registration and passes that registration to ZIA.
Why the other options are incorrect:
A). To bypass multifactor authentication (MFA) during the enrollment process: Bypassing MFA would weaken assurance. The token exchange registers the device/session with Zscaler; it is not a shortcut around the IdP or MFA policy.
B). To immediately grant the user access to Zscaler Private Access resources: A valid login proves identity, but it does not grant every private resource. ZPA still applies access policy, posture, and app-segment entitlement.
D). To share the authentication token with the SAML IdP to validate the user session: The SAML IdP issues the authentication assertion. Device registration after that belongs to the Zscaler Client Connector Portal and ZIA token workflow.

Zscaler's Microsoft 365 optimization model is designed to reduce latency and avoid breaking Microsoft- recommended connectivity patterns. The Office 365 One Click rule automatically applies recommended bypass/optimization behavior for Microsoft 365 traffic, including exemption from SSL inspection and other web-policy processing where required. Option C (Multiple distributed DNS resolvers providing local results) is correct because the immediate effect is optimized M365 handling rather than blanket inspection or blocking.
Why the other options are incorrect:
A). Single DNS resolver with forwarders providing centralized results: DNS resolves names to IP addresses; it is a support service, not an access protocol or scoring engine by itself.
B). Private MPLS in each branch office providing connection: Private MPLS backhaul keeps traffic on the old hub-and-spoke path instead of sending users directly to the nearest cloud service.
D). Optimized TCP Scaling for maximum throughput of files: TCP scaling can improve throughput for some flows, but it does not choose the nearest Microsoft 365 service endpoint.

Risk360 converts Zscaler telemetry into measurable cyber-risk views aligned to the breach lifecycle. Its key risk areas include prevent compromise, data loss, lateral propagation, and external attack surface. The exam wording is asking how the product organizes quantified risk rather than how many alerts exist or how quickly remediation occurs. Option D (A risk score is computed for each of the four stages of breach) is correct because Risk360 scores risk across the major breach stages, allowing administrators and executives to see where exposure is concentrated and prioritize remediation.
Why the other options are incorrect:
A). The number of risk events is totaled by location and combined: Counting risk events by location would give an event-volume report. Risk360 is meant to quantify exposure by breach-stage risk, which is more useful for prioritizing remediation.
B). A risk score is computed based on the number of remediations needed compared to the industry peer average: Peer benchmarking can be useful for executive comparison, but this question is asking how Risk360 structures the score internally: by the four breach stages.
C). Time to mitigate each identified risk is totaled, averaged, and tracked to show ongoing trends: Time to mitigate is an operations metric for remediation speed. It does not describe how Risk360 computes the risk score itself.