Botnet Protection targets command-and-control behavior, including known C2 destinations, suspicious command traffic, and unknown C2 patterns detected through analytics or AI/ML. IPS and YARA-style content analysis are used to identify C2-like traffic and malicious patterns, not general malware categories alone. Option B (Connections to known C & C servers, Command traffic (sending / receiving), Unknown C & C using AI/ML) is correct because Command and Control traffic is the botnet behavior being protected against.
Why the other options are incorrect:
A). Malicious file downloads, Command traffic (sending / receiving), Data exfiltration: Malicious-file downloads and data exfiltration are important protections, but Botnet Protection specifically focuses on C2 destinations and command traffic.
C). Connections to known C & C servers, Detection of phishing sites, Access to spam sites: Phishing starts with social engineering: fake messages, links, or login pages. The question describes a legitimate common website being seeded with malicious JavaScript.
D). Vulnerabilities in web server applications, Unknown C & C using AI/ML, Vulnerable ActiveX controls: C2/botnet controls detect hosts communicating with known or suspected command-and-control infrastructure.

In ZPA, Server Groups define which App Connector Groups can reach the application servers behind an Application Segment. They are part of the mapping that lets ZPA choose the correct outbound connector path for private application traffic. Option C (Maps App Connector Groups to Application Segments) is correct because Server Groups map App Connector Groups to Application Segments for reachability and steering.
Why the other options are incorrect:
A). Maps FQDNs to IP Addresses: DNS resolves names to IP addresses; it is a support service, not an access protocol or scoring engine by itself.
B). Maps Applications to FQDNs: DNS resolves names to IP addresses; it is a support service, not an access protocol or scoring engine by itself.
D). Maps Applications to Application Groups: Mapping applications to application groups is a policy- organization task. Server Groups specifically map reachable application servers to App Connector Groups.

Zscaler's unified data-protection model reduces the policy and visibility gaps created by separate point products. A unified stack lets DLP, SaaS Security, endpoint controls, cloud-data protection, and posture insight share consistent classification and enforcement logic. Option D (Eliminating of gaps associated with multiple point solutions) is correct because eliminating gaps between disconnected tools is a major advantage of unified data protection.
Why the other options are incorrect:
A). Reducing visibility into data movement across the cloud: Reducing visibility is a bad outcome. Unified data protection is valuable because it increases visibility across channels and closes blind spots.
B). Working together with traditional hardware appliances: Traditional hardware appliances may still exist, but the advantage being tested is not appliance coexistence. It is eliminating gaps between separate point products.
C). Increasing complexity and manageability in DLP security policies: Increasing complexity is the problem unified data protection is meant to reduce. A single policy/control model should simplify DLP operations.

Client Connector profile changes do not always take effect at the moment an administrator saves them. App Profile policy settings such as logout password follow the client's scheduled policy-refresh behavior. The tested interval for these policy updates is sixty minutes. Option D (Policy updates occur every 60 minutes, so the logout password will be in effect after the next scheduled update) is correct because the new logout password is applied after the next scheduled policy update.
Why the other options are incorrect:
A). Policy updates happen in real time, so the new logout password is in effect as soon as the change is saved: The logout password is an App Profile control that prevents users from casually signing out or disabling the client.
B). The new logout password will be in effect after the Activate button is clicked in the Admin portal:
The logout password is an App Profile control that prevents users from casually signing out or disabling the client.
C). The new logout password will be in effect after the user clicks Update Policy on the client: The logout password is an App Profile control that prevents users from casually signing out or disabling the client.

ZDX Advanced client performance uses live telemetry from real user sessions to measure the experience of internet and private applications. Synthetic probes are useful for availability and path testing, but client performance is gathered by continuously observing active user sessions, endpoint condition, and traffic behavior. Option B (By constantly analyzing live user sessions to both Internet and Private applications and measuring the performance of those sessions) is correct because ZDX Advanced client performance is based on live session analysis.
Why the other options are incorrect:
A). By generating synthetic transactions to designated Internet and Private applications every 5 minutes and measuring the performance of those sessions: Synthetic transactions are scheduled probes that test applications independently of live user sessions.
C). By using AI predictive analysis ZDX can extrapolate near-term client performance based upon recent past data observed: AI prediction would forecast likely performance, but the tested ZDX function measures actual client/application sessions.
D). By constantly analyzing live user sessions to critical SaaS applications and measuring the performance of those sessions: SaaS applications are handled by ZIA controls such as URL Filtering, Cloud App Control, and DLP, not by ZPA App Connectors.