Advanced Firewall extends standard firewall capabilities with DNS Tunnel and DNS Application Control.
Those controls detect and manage DNS-based tunneling, command channels, or application behavior that simple network-service rules cannot adequately control. Option D (DNS Tunnel and DNS Application Control) is correct because DNS Tunnel and DNS Application Control are advanced firewall features.
Why the other options are incorrect:
A). Destination NAT: Destination NAT rewrites destination addresses. The tested Advanced Firewall value is DNS tunnel/application control, not NAT translation.
B). FQDN Filtering with wildcard: FQDN filtering applies rules to domain names, including wildcard domain patterns where supported.
C). DNS Dashboards, Insights and Logs: DNS resolves names to IP addresses; it is a support service, not an access protocol or scoring engine by itself.

Trusted Network Detection relies on observable network signals from the endpoint. Hostname/IP resolution, DNS server, and DNS search domain are valid criteria because they indicate whether the device is attached to a known corporate network. Option D (DNS Search Domain, DNS Server, Hostname Resolution) is correct because it lists supported trusted-network criteria.
Why the other options are incorrect:
A). Hostname Resolution, Network Adapter IP, Default Gateway: Default Gateway can identify a local network path, but it is not always one of the exact trusted-network criteria set in this item.
B). DNS Servers, DNS Search Domain, Network Adapter IP: DNS Search Domain is a trusted-network signal because corporate networks commonly push recognizable suffixes to endpoints.
C). Hostname Resolution, DNS Servers, Geo Location: DNS Server criteria identify a trusted network by checking whether the endpoint sees expected internal resolver addresses.

Cloud Browser Isolation protects users by rendering risky web content in a remote browser environment instead of on the endpoint. URL Filtering can use Isolate as an action, so users may still access selected untrusted sites while scripts, active content, and browser-exploit risk remain separated from the device.
Option D (Yes. Isolate is a possible Action for URL Filtering) is correct because isolation is an enforceable URL Filtering action, not a separate manual workaround.
Why the other options are incorrect:
A). No. Cloud Browser Isolation is a separate platform: Browser Isolation renders web content remotely so active content never executes directly on the endpoint.
B). No. Cloud Browser Isolation is only a feature of Advanced Threat Defense: Browser Isolation renders web content remotely so active content never executes directly on the endpoint.
C). Yes. After blocking access to a site, the user can manually switch on isolation: Browser Isolation renders web content remotely so active content never executes directly on the endpoint.

Tamper proofing prevents users or malware from disabling or altering Client Connector after installation. The installer must include the explicit anti-tampering flag to activate that protection during deployment. Option D (--enableAntiTampering) is correct because --enableAntiTampering is the command-line parameter for this control.
Why the other options are incorrect:
A). --secureInstall: --secureInstall sounds like a hardening flag, but the ZCC installer parameter for tamper proofing is --enableAntiTampering.
B). --antiTamper: Anti-tampering prevents local users from disabling or removing Client Connector protections.
C). --disableTampering: Anti-tampering prevents local users from disabling or removing Client Connector protections.

The cloudName and userDomain installer options let Client Connector identify the correct Zscaler cloud and automatically route the user to the corporate SAML IdP. This removes user choice and reduces onboarding errors during first launch. Option C (--cloudName and --userDomain) is correct because those parameters provide cloud and domain discovery for SAML redirection.
Why the other options are incorrect:
A). --deviceToken and --strictEnforcement: deviceToken is used for device enrollment workflows, not for every SAML redirection or strict-enforcement scenario.
B). This is automatic when SAML is configured. No options are required: SAML provides browser-based federation by carrying signed assertions from the identity provider to the service provider.
D). --policyToken and --userDomain: userDomain tells Client Connector the user login domain so it can route enrollment toward the right IdP.