A network team needs to prevent recurring congestion while meeting performance goals for critical applications. The team has several months of application-usage and bandwidth data across multiple sites.
What approach is most appropriate for avoiding congestion?

• A. Defer policy changes until user complaints stabilize, then adjust application classes based on the most recent incident set
• B. Convert several high-usage business applications to the Silver class to distribute utilization more evenly across queues
• C. Analyze multiweek trends by location to identify consistently congested circuits and plan targeted capacity upgrades before peak periods
• D. Relax quality-of-service constraints to reduce strict queue boundaries that may be causing packet drops

For a deployment using both ZIA and ZPA set of services, what is the best authentication solution?

• A. Use forms Authentication in ZPA and SAML in ZIA
• B. Use forms Authentication for both ZIA and ZPA
• C. Configure Authentication using SAML on both ZIA and ZPA
• D. Use forms Authentication in ZIA and SAML in ZPA

A branch location must connect to Zscaler for web inspection. The underlay is trusted, the site requires a static egress IP mapped to the location, expected throughput is 700 Mbps, and high availability is not required.
Which tunnel approach and count meet these requirements with the least overhead?

• A. Configure one GRE tunnel to a regional Service Edge and bind the location to a static IP to meet the throughput target
• B. Establish two IPSec peers with conservative IKE lifetimes to reduce rekey churn and configure the location's static IP
• C. Provision two GRE tunnels to separate Service Edges and balance traffic through policy-based routing
• D. Configure one IPSec tunnel to the regional Service Edge and declare the bandwidth expectation to match the site profile

An administrator must brief a cross-functional team on the prerequisites for allowing a single App Connector group in AWS to serve applications in an on-premises data center over Direct Connect.
Which requirement is most critical to state to avoid reachability gaps and App Connector misbehavior?

• A. Confirm that ZPA control-plane addresses are reachable through inbound ACLs from the Zscaler cloud and that application probes are source-NATed at the data-center edge
• B. Confirm that the on-premises firewalls publish NAT to expose the application servers for App Connector probes and that reverse DNS is authoritative in AWS
• C. Confirm that client microtunnels terminate on the AWS App Connectors through inbound firewall rules and that Direct Connect advertises public prefixes
• D. Confirm that internal routing permits the App Connector subnets to reach the on-premises application subnets and that App Connector egress to ZPA Service Edges remains outbound TLS over permitted paths

An administrator suspects that users in Europe are being routed to a distant service edge, inflating latency before traffic reaches a SaaS provider.
Which ZDX diagnostic provides evidence of inefficient client-to-service-edge routing?

• A. Check endpoint CPU and memory telemetry to argue that device constraints are producing perceived routing inefficiencies
• B. Audit alerting thresholds for regional score drops and assume that the trigger implies service-edge misalignment
• C. Examine CloudPath probes for the client-to-service-edge leg to verify latency spikes and excessive hop counts
• D. Review Page Fetch Time graphs for the application and deduce that service-edge selection is suboptimal based on slow loads