When using a Domain Joined posture element to allow access in a ZPA Access Policy, which statement is true?
A.
Only some Linux operating systems have Domain Joined posture profile support in Zscaler.
B.
When a ZPA Browser Access client attempts to access an application, Zscaler can determine if that device is joined to a particular domain.
C.
If a 2nd domain and a sub-domain are needed in the Access Policy rule you must create a 2nd posture profile with the other domain and add it to the Access Policy.
D.
Zscaler ZPA can contact the IDP such as Azure AD out-of-band to verify if a device is joined to a particular domain.
The Domain Joined posture element in ZPA evaluates whether a device belongs to a specific Active Directory domain. ZPA performs this evaluation using the device’s local posture signals, either through the Zscaler Client Connector posture engine or through the browser-based posture evaluation framework used in ZPA Browser Access. When a user connects via Browser Access, ZPA can still determine domain membership by inspecting the allowed browser posture attributes provided by the endpoint, enabling device-based Zero Trust controls without requiring a full Client Connector installation.
Linux endpoints do not support domain-joined posture verification, making option A incorrect. Domain join validation is performed at the device level, not through the Identity Provider, because IdPs validate users, not device domain status, eliminating option D. ZPA’s posture configuration allows you to define multiple domains within a single posture profile, so creating a second posture profile is unnecessary, making option C incorrect.
Therefore, the correct statement is that ZPA Browser Access can determine whether the device is joined to the specified domain, which aligns with the expected behavior of the domain-joined posture element.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit