Z-Tunnel 2.0 extends forwarding beyond web proxy traffic by securing all IP unicast traffic through DTLS/TLS tunnels to the Zero Trust Exchange. This enables Cloud Firewall and other controls to inspect all TCP and UDP ports, and ICMP where supported, rather than only browser HTTP/HTTPS flows. Option C (Zscaler Client Connector will encapsulate the user's traffic in DTLS/TLS tunnels to the ZTE) is correct because Tunnel 2.0 is the all-ports-and-protocols forwarding model for Client Connector.

Why the other options are incorrect:

A. Zscaler Client Connector will encapsulate the user's traffic in GRE tunnels to the ZTE: Zscaler Client Connector is the endpoint agent that steers traffic, authenticates users, reports posture, and supplies ZDX telemetry.

B. Zscaler Client Connector will encapsulate the user's traffic in IPSec tunnels to the ZTE: IPS inspects traffic inline for exploit signatures and attack patterns, then blocks or resets offending sessions.

D. Zscaler Client Connector will encapsulate the user's traffic in HTTP Connect tunnels to the ZTE: Zscaler Client Connector is the endpoint agent that steers traffic, authenticates users, reports posture, and supplies ZDX telemetry.