Environmental Science Quiz

Authentication and Authorization to the Zero Trust Exchange

• The first step in connecting to the Zero Trust Exchange is verifying identity and context. This typically involves connecting to a SAML identity provider (IdP), but other methods like LDAP or a hosted database are also possible.
• User and device context allows risk control through policies.
• Zscaler Internet Access secures SaaS applications and internet applications.
• Zscaler Private Access manages connectivity to private applications and resources on infrastructure as a service (IaaS), platform as a service (PaaS), or private data centers.
• Identity integration uses SAML or LDAP authentication with customer directories.
• Policies are applied based on identity and device posture, and access activities are logged and reported.

SAML Authentication

• SAML is a mechanism for federating identities between an identity store and applications, enabling single sign-on (SSO) functionality without requiring reauthentication.
• SAML uses three key components: the Service Provider (SP), Identity Provider (IdP), and Security Assertions.
• The SP represents the application, the IdP authenticates users or devices, and security assertions confirm authentication for access.

Authentication Flow: SAML

• The authentication process begins with a request for an application; if not authenticated, a redirect to Zscaler Internet Access or Zscaler Private Access happens.
• Depending on the application type (public or private) a SAML authentication request is sent to the IdP.
• The IdP verifies the user's identity and returns a SAML assertion to the service provider (SP).
• Zscaler acts as the SP, and the user is authenticated at Zscaler.
• The request for the application can then resume via the Zscaler Zero Trust Exchange.

SCIM Authorization

• SCIM (System for Cross-domain Identity Management) automates user identity information exchange between identity domains.
• It supports addition, deletion, and updating of users and the ability to apply policy based on user or group attributes.
• It's useful for efficiently managing and updating user attributes based on changes in the home directory.
• Zscaler recommends SCIM provisioning.
• SCIM operations include Create, Read, Update, Delete, SSO, Replace, Search, and Bulk operations.

Advantages and Disadvantages of SCIM

• Advantages: Automatic updates (e.g., group changes), user deletion capabilities
• Disadvantages: Not supported by all IdPs

ZPA Support for SCIM 2.0

• ZPA support for SCIM 2.0 includes operations for adding, deleting, and updating users, and applying policies based on SCIM attributes.
• SCIM Data Management creates lists for users, groups, and attributes in ZPA, and manages these within the primary directory IdP.
• SCIM Synchronization happens periodically, with an update interval of ~40 minutes, and may be manually triggered.

Zscaler Client Connector

• Zscaler's lightweight app enforces security policies and access controls regardless of device, location, or application.
• It creates a tunnel to the Zero Trust Exchange for the protection of SaaS and internet-bound traffic.

Authenticated Tunnels

• ZTunnel 1.0 uses HTTP CONNECT tunnels, while ZTunnel 2.0 uses DTLS with fallback to TLS, supporting various traffic types and inspection by Zscaler Firewall.
• Enforced PAC (Proxy Auto-Config) mode instruments the PAC file, forcing browser traffic to go through Zscaler Internet Access, while "None" mode leverages group policy or default browser configuration.

Forwarding Profile: Trusted Network Detection

• Trusted network detection determines whether a user is in the office, branch, or data center using criteria like hostname and IP or DNS search domains.
• These criteria are used to select appropriate forwarding profiles.

Forwarding Profile: Multiple Trusted Networks

• Define multiple trusted networks to determine which forwarding profile will be used for a given user or device.

Forwarding Profile: Profile Action for ZIA

• Choose a trusted network criteria and multiple trusted networks within a forwarding profile.
• Use a tunneled mode specifically (ZTunnel 2.0 with DTLS) to capture all traffic to the Zscaler cloud.

Forwarding Profile: System Proxy Settings

• Configure how the browser (or OS) receives proxy settings, often via a no-proxy configuration for more efficient operation.
• Automatic detection of proxy settings, configuration of a custom proxy, usage of a proxy server for the local network, and GPO update.

ZIA: PAC Files

• ZIA uses JavaScript functions (PACS) hosted on the cloud to route traffic to either direct (no proxy) or proxy routes (through Zscaler).

ZIA: Browser Behavior - PAC to Tunnel Mode

• The browser handles authentication differently when Zscaler is on for SSL inspections.

Tunnel Mode - Packet Filter Based

• ZTunnels intercept traffic based on network layer protocols such as ports 80 or 443.

Tunnel Mode - Route-Based Flow

• Route-based tunneling uses a routing table for traffic routing decisions.

ZIA Enrollment Process

• Zscaler Client Connector (ZCC) initiates the process by connecting to an IdP for authentication (such as Okta, Microsoft Azure AD, CrowdStrike, etc.) to obtain a SAML response, which is used to validate the user's identity.
• ZCC then registers the device, and requests credentials to Zscaler Internet Access (ZIA) service, authenticating users.

ZPA Enrollment Process

• The ZPA enrollment process is similar to ZIA, using a separate connection with Zscaler Private Access (ZPA).

Client Connector Intervals

• The Zscaler Client Connector refreshes information about applications, app profiles, forwarding profiles, PAC files, and policies at defined intervals.
• These intervals account for various changes such as network connections (connect/disconnect), policy updates, and changes in PAC files, and app profile changes.

Rotating Passwords with App Profiles

• Zscaler Client Connector enforces a per-configuration password for applications that are locked down to prevent disabling/uninstalling the application
• One-time passwords are provided in this case.

Device Posture and Posture Checks

• Device Posture checks and assesses devices for trust through various checks.
• checks can be limited for Android and iOS devices.
• BYOD and corporate device standards.

Installing Client Connector

• Details on how to install and maintain the Zscaler Client Connector.

ZDX Architecture overview

• Description of the Zscaler Digital Experience (ZDX) architecture.

ZDX Features & Functionality

• Features of the Zscaler Digital Experience (ZDX) platform for monitoring user experience.

ZDX Use Cases

• Examples of the use cases in ZDX platform.

ZDX APIs

• ZDX APIs for integrating digital experience insights with tools like ServiceNow for remediation workflows.

Access Control

• The role of access control services in the Zero Trust Exchange, its capabilities (Firewall, DNS, URL Filtering, etc.), and configuration for optimized application and user experience.

Basic Troubleshooting Tools & Support

• Zscaler's troubleshooting tools, including the proxy test, performance testing, admin UI logs, Zscaler Analyzer output, packet capture, and Zscaler Trust functionalities, along with steps for capturing these data types.

Key Differentiator 

• Zscaler's key differentiators, including its size, threat intelligence, and expert support.

Advanced Threat Protection

• The details of Zscaler's threat protection capabilities, focusing on common malware types, their delivery mechanisms, and Zscaler's protection capabilities.

URL Filtering

• Zscaler's URL Filtering capabilities for blocking inappropriate or high-risk URL categories.

DLP Inline for Web & SaaS

• Zscaler's DLP (Data Loss Prevention) capabilities.
• Custom dictionaries and other features available to support DLP.

Security Posture Management

• Data protection using security posture management within Zscaler's network

Incident Management

• Zscaler's Incident Management capabilities and capabilities for handling various incidents or issues.

Zscaler Self Help Services

• Finding and using Zscaler's various support tools to help resolve issues.

Test your knowledge on environmental issues such as climate change, ocean acidification, and biodiversity. This quiz covers the impact of various substances on the environment and human activities that affect ecological balance. See how well you understand the interconnectedness of these topics.