Z-Tunnel 2.0 extends forwarding beyond web proxy traffic by securing all IP unicast traffic through DTLS
/TLS tunnels to the Zero Trust Exchange. This enables Cloud Firewall and other controls to inspect all TCP and UDP ports, and ICMP where supported, rather than only browser HTTP/HTTPS flows. Option D (Z- Tunnel 2.0) is correct because Tunnel 2.0 is the all-ports-and-protocols forwarding model for Client Connector.
Why the other options are incorrect:
A). Secure Shell (SSH): RDP, SSH, and VNC are privileged remote access protocols for desktop, shell, and graphical administration.
B). Tunnel with local proxy: Tunnel with Local Proxy creates a loopback proxy path on the endpoint for forwarding selected traffic.
C). Enforce PAC: Enforced PAC controls browser or system proxy behavior. Z-Tunnel 2.0 is the mechanism that secures all IP unicast traffic from the endpoint.

Tenant Restriction lets ZIA distinguish the approved corporate tenant of a SaaS application from personal or unmanaged tenants. That matters when the user is on an unmanaged device, because the administrator may allow the corporate tenant only from trusted or managed contexts. Option A (Tenant Restriction) is correct because Tenant Restriction is the SaaS-specific control that enforces corporate-tenant access boundaries.
Why the other options are incorrect:
B). Identity Proxy: Identity Proxy helps broker identity and authentication flows for SaaS access. Tenant Restriction is the control that separates corporate SaaS tenants from personal ones.
C). Out-of-band Application Access: Out-of-band CASB works through SaaS APIs to inspect or remediate content already sitting inside cloud applications.
D). SaaS Application Access: SaaS Application Access is a broad access concept. The specific ZIA feature that blocks unmanaged-device access to a SaaS tenant is Tenant Restriction.

Cloud Browser Isolation protects users by rendering risky web content in a remote browser environment instead of on the endpoint. URL Filtering can use Isolate as an action, so users may still access selected untrusted sites while scripts, active content, and browser-exploit risk remain separated from the device.
Option B (Inspection of all ports and protocols via Cloud Firewall) is correct because isolation is an enforceable URL Filtering action, not a separate manual workaround.
Why the other options are incorrect:
A). Enables SSL Inspection for Client Connector: SSL Inspection is a ZIA decryption setting. The Client Connector option in this question controls tunnel/forwarding behavior, not SSL policy.
C). Enables Browser Isolation: Browser Isolation renders web content remotely so active content never executes directly on the endpoint.
D). Enables multicast traffic: Multicast traffic is not what Zscaler Client Connector tunnel configuration is enabling here. The setting concerns endpoint traffic forwarding to Zscaler.

ZPA Access Policy rules use identity, user/group, device posture, and contextual signals to decide private- application access. Valid criteria are enforcement attributes that ZPA can evaluate, such as group membership, risk score, domain-joined state, and certificate trust. Option B (Yes. Controls for segmentation and conditional access are part of the Access Control Services) is correct because all listed criteria are legitimate policy inputs for ZPA access decisions.
Why the other options are incorrect:
A). No. Access Control Services will only control access to the Internet and cloud applications: Access Control Services are not limited to internet and cloud-app access. They also include segmentation and conditional access patterns that reduce lateral movement.
C). Yes. The Cloud Firewall will detect network segments and provide conditional access: Zscaler Cloud Firewall enforces network-service and application rules for non-web and firewall-controlled traffic.
D). No. The endpoint firewall will detect network segments and steer access: Endpoint firewalls can filter traffic locally on a device. The Zscaler Access Control suite prevents lateral movement through segmentation and conditional access, not by relying on each endpoint firewall.

File Type Control reduces exposure by limiting which file categories users can download or upload, especially from risky or untrusted destinations. It is not a monitoring score or administrative RBAC control; it is a content-control policy that directly limits malicious or high-risk file exposure. Option C (File type Controls) is correct because File Type Control can block dangerous content classes before they reach the endpoint.
Why the other options are incorrect:
A). Role Based Access control (RBAC): RBAC limits administrator privileges by role and scope; it does not inspect user web content or files.
B). Bandwidth Controls: Bandwidth Control shapes outbound traffic to manage congestion and prioritize business use.
D). Zscaler Digital Experience: ZDX monitors experience and helps troubleshoot performance. It does not limit malicious file/content exposure through policy enforcement.