ZDTA is the proctored exam at the end of Zscaler for Users — Administrator (EDU-200). The current public blueprint is six domains: Policy & Security 29%, User & Device 18%, Platform 18%, Monitoring 13%, Troubleshooting 13%, Integration 9%. It lists 60 questions / 90 minutes. Zscaler does not publish a cut score. Study by mapping those domains back to lessons 01–13, then practice tickets: expected flow, config object, log field, safe fix, proof. Current catalog after ZDTA is ZDTE (EDU-202) or ZDXA — not retired ZCCA-IA / ZCCA-PA names.
1. Why this page exists
A recruiter searches for the string ZDTA. A hiring manager who has run a ZIA rollout does not. They ask which engine blocked the URL after URL Filtering said Allowed, or what you do when half the fleet fails posture after a Windows update.
Paper certification dies in the first follow-up. The cert is a forcing function to study. The interview is a ticket. This lesson is the join: official blueprint on one side, production answers on the other.
Older posts (including a prior version of this page) listed seven domains such as “Cyber Security Services 20% / Basic Connectivity 20%” and an “80% pass mark.” Those numbers are not on the current official ZDTA blueprint PDF. If a JD still says ZCCA-IA or ZCCA-PA, translate it to ZDTA + day-job depth — do not invent a current “EDP / ZCCP” ladder unless Zscaler publishes it again.
2. Mental model — two exams
Treat prep as two different tests that share the same lab stories.
Exam A · ZDTA
Closed-book, proctored, timed. You prove you can administer the Zero Trust Exchange across identity, platform, policy, logs, incidents, and integrations. Authority = current blueprint + study guide.
Exam B · interview
Open-ended ticket. You prove you can pick a first check, name a log field, and refuse the unsafe shortcut. Authority = a story you actually ran in lessons 01–13.
Read top → down. Diamond = is this a timed item or a spoken ticket? Same lab story feeds both.
I study the current blueprint, not a dump. I map each domain to a lesson I can reopen. In an interview I start with the first check and the evidence field — not the product slogan.
3. Official blueprint → lesson map
Primary source: Zscaler Digital Transformation Administrator blueprint (public PDF). It is a professional-level exam, 60 questions, 90 minutes, recommended after EDU-200 course and lab, with a suggested background of hands-on Zscaler time plus broader network/security experience.
The EDU-200 marketing page currently says “90 minutes to answer 50 questions.” Treat the exam blueprint as the exam authority and re-check both the day you book. The same PDF says topics are guidelines and may change without notice.
Bar length tracks the published weight. Policy is almost a third of the exam.
| Official domain | Weight | Re-read these lessons | What “ready” looks like |
|---|---|---|---|
| Policy & Security Configuration | 29% | 05 URL + Cloud App, 06 SSL + File Type, 07 Threat, 08 DLP + CASB, 11 ZPA policies, 12 CBI + SIPA | You can say which engine fires, and you can name a scoped bypass instead of “turn it off.” |
| User & Device Management | 18% | 04 Auth + ZCC, Entra SAML + SCIM gold | Provision then authenticate. Username appears in the web log. IdP / ACS are exempt from the tunnel. |
| Platform Management | 18% | 01 Foundation, 02 ZIA architecture, 03 Forwarding, 09 ZPA architecture, 10 Connectors | CA / Public Service Edge / Nanolog. GRE vs IPSec vs ZCC. Connector egress 443, no inbound VIP. |
| Monitoring, Reporting & Analytics | 13% | 13 Logs, ZDX, troubleshoot | Insights vs ZDX vs NSS. Green ZDX score is not the same as a slow transaction. |
| Troubleshooting & Incident Response | 13% | 13 + traps in 04, 06, 10 | First check, not reboot. Quote the field that closes the ticket. |
| Integration & Optimization | 9% | 04 (SAML/SCIM), 03 (forwarding), 13 (NSS / SIEM) | One IdP as the Zscaler front door. NSS gap is a data-loss incident, not “restart Splunk and leave.” |
Academy outcomes (not extra invented domains) sit across that table: deploy the Exchange, secure user-to-internet traffic, enable basic policy, connect private apps via Client Connector, monitor experience. The expansive objective list lives in the ZDTA study guide — download the current file; do not memorize a third-party dump.
4. How to choose the next cert
Zscaler’s public certification catalog (FAQ last updated 30 Jul 2026) lists three proctored exams: ZDTA, ZDTE, ZDXA. Each attempt is US$300, non-refundable. Credentials are valid two years; recertify by passing the current exam, starting 90 days before expiry.
| Credential | Path | Pick it when | Do not pick it when |
|---|---|---|---|
| ZDTA | EDU-200 Administrator | You need the platform admin badge hiring screens for. Do this first. | You only want a LinkedIn badge and have never opened Insights. |
| ZDTE | EDU-202 Engineer | Day-job is advanced identity, connectivity, Private Service Edge, deeper ZIA/ZPA services. | You have not yet administered a tenant. Engineer assumes the admin path. |
| ZDXA | Digital Experience Administrator | Your tickets are “Teams is choppy” and hop-by-hop proof, not policy design. | You have never run a ZDX probe or compared it to a real Web Insights row. |
| Z-Badges | Academy specializations | You already hold a cert and need a product-depth complement. | A JD asked for ZDTA and you try to substitute a badge. |
ZCCA-IA / ZCCA-PA (and older ZIA Admin / ZPA Admin wording) are retired administrator tracks. If a recruiter uses those strings, answer with ZDTA plus the matching day-job depth (ZIA policy vs ZPA connectors). Do not invent a current “EDP” or “ZCCP” sequence unless you have a live Academy page in front of you.
5. Study + exam-day runbook
Four weeks is enough if lessons 01–13 are already done. Less than that is memorization. More than six without labs is decay. Source for exam mechanics: Certification Exam FAQs.
Side A — Academy / external
-
Create the Cyber Academy account
Required before you can schedule. Customer, partner, and public-sector portals differ. You will get a Zscaler Client Candidate ID (ZCID) for Pearson VUE.
-
Download the current blueprint + study guide
Do this the week you book, not from a screenshot in a WhatsApp group. Confirm domain names and the 60 / 90 numbers still match.
-
Sit the official ZDTA practice exam
It is a familiarization tool, not a guarantee. Group misses by blueprint domain. A practice pass is not a certification result.
Side B — this course (product)
-
Week 1 — User 18% + Platform 18%
Re-read 01–04 and 09–10. Lab:
ip.zscaler.com, one forwarding method, one SAML login that shows a username in Web Insights, one Connector that is outbound 443 only. -
Week 2 — Policy 29%
Re-read 05–08, 11–12. Lab: one URL rule, one SSL host bypass, one threat/sandbox story, one DLP dictionary that you tighten instead of disable, one narrow App Segment.
-
Week 3 — Monitor 13% + Troubleshoot 13%
Re-read 13. Lab: one Insights vs ATP mismatch, one ZDX hop story, one posture-fail first check. Write the evidence field before the fix.
-
Week 4 — Integration 9% + spoken tickets
Re-read the eight scenarios below out loud. Time yourself. If a domain from the practice exam is weak, reopen that lesson — do not reread the whole course.
Side C — exam day + proof
-
Schedule Pearson VUE or OnVUE
US$300 per attempt. Cancel a test-center seat at least 48 hours ahead. OnVUE: personal PC preferred, Windows 10 / macOS 13+, one display, 6 Mbps down / 2 Mbps up, government photo ID, arrive/login 15 minutes early. Breaks are not permitted. Work laptops often fail the secure browser.
-
Do not invent a target percentage
Official FAQ: Zscaler does not reveal the cut score or how many items you must get right. Pass/fail is on-screen immediately. Failures get a breakdown by blueprint area. Passers get Pass only — no item review.
-
After a pass
Accept the Credly badge, download the certificate from Share. Recert window opens 90 days before the two-year mark. Same US$300 exam fee.
Zscaler Certification Exam FAQs (30 Jul 2026) + ZDTA blueprint PDF + ZDTA Academy page (US$300, English).
6. Interview loop after you pass
The loop is the same every time: ticket → first check → object → log → scoped fix → proof. That is also how you should have studied weeks 2–4.
What they listen for
Order. You name the engine, the object (rule / segment / posture check), and the page that proves it.
What fails you
Disable the engine, open *.internal.corp on all ports, or argue with a user because ZDX is green.
7. Eight scenario answers
Each stem is a production ticket. Answer in this order: direct line, why production cares, the weak trap, the sentence you actually say, the evidence field.
Q1 · Scenario — 50-branch forwarding
A 50-branch bank asks you to pick GRE, IPSec, PAC, and Zscaler Client Connector for ZIA. They want one default.
Strong framing (say this)
IPSec at the branch, ZCC on every roaming device, PAC as a scoped override. I can show the location object and the ZCC App Profile that match that sentence.
Evidence to name
Lesson 03 forwarding; Admin → Locations; ZCC App Profile / forwarding profile; ip.zscaler.com from a branch PC and from a home laptop.
Q2 · Troubleshoot — SSL breaks a bank app
One user group cannot open a partner banking site after you enabled SSL Inspection. Everyone else is fine.
Strong framing (say this)
I filter Insights on user + URL, look for a TLS error versus a 403 after decrypt, then I either push the root CA or bypass the pinned host.
Evidence to name
Lesson 06 SSL; Insights Web — policy / SSL columns; SSL Inspection bypass list; device cert store.
Q3 · Unsafe shortcut — wildcard App Segment
A developer asks for Application Segment *.internal.corp on all TCP ports “so we can move fast.”
Strong framing (say this)
App Segment is the what — FQDN and ports. I will not publish all ports on a star domain. Give me the list or we schedule discovery.
Q4 · Architecture — two ZPA policies, allow and deny
The user is in two groups. For the same App Segment, one Access Policy allows and one denies. Which fires?
Strong framing (say this)
I screenshot the policy order, say which rule number hit, and I keep an explicit deny-log at the bottom so default deny is visible.
Evidence to name
Lesson 11 ZPA policies; Access Policy list order; ZPA diagnostics / user activity for the matched policy name.
Q5 · Evidence — URL Filtering says Allowed
The user is blocked. Insights Web shows URL Filtering: Allowed. Where do you look next?
Strong framing (say this)
I open the same transaction and read every policy column. Allowed in URL Filtering is not the ticket closer.
Q6 · Compare — what do you sit after ZDTA?
You passed ZDTA. Your week is URL, SSL, DLP, and NSS into Splunk. A peer says “go EDP-ZIA or ZCCP next.”
Strong framing (say this)
ZDTA first. Next exam matches the tickets I already own. I will screenshot the Academy page in the interview if the JD is stale.
Evidence to name
Academy certification page; FAQ (ZDTA / ZDTE / ZDXA); your last 20 tickets tagged ZIA vs ZPA vs ZDX.
Q7 · Troubleshoot — posture fails after an OS upgrade
Half the Windows fleet fails the ZPA posture check (AV running + disk encryption) the morning after a feature update.
Strong framing (say this)
I pull ZCC / ZPA diagnostics for one failed device, name the failing check, then I update that check — not the entire Zero Trust policy.
Q8 · Scenario — DLP false-positive flood
After a dictionary update, DLP incidents explode. The CISO wants the noise gone before lunch.
Strong framing (say this)
I isolate the dictionary that broke, I do not touch the other rules, and I can show the incident count dropping after the tighten.
Evidence to name
Lesson 08 DLP + CASB; DLP incident viewer; dictionary / engine; rule action alert vs block.
8. Traps + proof checklist
| Trap | What it looks like | Safer path |
|---|---|---|
| Invented blueprint | “Seven domains, 80% to pass, connectivity 20%.” | Open the current PDF. Six domains. Cut score unpublished. |
| Retired cert names | Studying ZCCA-IA dumps, or quoting EDP/ZCCP as live exams. | ZDTA → ZDTE or ZDXA from the live Academy page. |
| Bypass vs disable | SSL / DLP / posture turned off for the org. | Host, rule, or check scoped. Document the exception. |
| One-engine thinking | URL Filtering Allowed, so “Zscaler is broken.” | Read ATP, File Type, DLP, Cloud App, SSL on the same row. |
| Practice exam = cert | Stopping study after a green practice score. | Use misses to reopen one lesson. The real exam is proctored and unpaid-for-refund. |
| Green ZDX vs angry user | “Score 92, you’re wrong.” | RUM / Web Insights for that user’s transactions, then the endpoint. |
- You can list the six official domains with the published percentages from memory, and you refuse to quote a cut score.
- You can point each domain at a lesson URL in this course.
- You have downloaded the current blueprint and study guide (file dates, not a Slack screenshot).
- You can say ZDTA vs ZDTE vs ZDXA in one sentence each, from the public catalog.
- You can deliver Q2, Q3, Q5, and Q7 out loud in under two minutes each, with an evidence field.
- You know exam day: US$300, Pearson VUE or OnVUE, no breaks, Credly badge, 2-year recert.
Knowledge check
Six judgment items. Same traps as the runbook and interview block. Check answers, then reset if you miss any.
Sources
- ZDTA exam blueprint (PDF) — 60 questions, 90 minutes, six domain weights. Primary exam-scope source.
- ZDTA certification page — EDU-200 capstone, five outcomes, US$300, English, blueprint + study-guide links.
- ZDTA study guide (PDF) — expansive objectives. Download current file; do not quote third-party dumps.
- Zscaler for Users — Administrator (EDU-200) — recommended learning path. Note: this page currently says 50 questions / 90 minutes; treat the blueprint as the exam authority and re-check both.
- Certification Exam FAQs (30 Jul 2026) — catalog ZDTA / ZDTE / ZDXA, US$300, unpublished cut score, 2-year validity, recert window, OnVUE / Pearson VUE rules.
- Zscaler Certification overview — current public ladder + Z-Badges + Credly.
- ZDTE certification page — EDU-202 engineer path.
- Pearson VUE — Zscaler — scheduling / OnVUE delivery.
- Customer Success — ZDTA exam hub — registration, practice exam, blueprint links (login may be required).
Related: 01 Foundation · 03 Forwarding · 04 Auth + ZCC · Entra SAML + SCIM · 06 SSL · 08 DLP + CASB · 11 ZPA policies · 13 Logs + ZDX