Exam ZDTA Topic 3 Question 148 Discussion

Zscaler Deception detects intruders by placing decoys, lures, and fake credentials inside the environment.
Legitimate users should not interact with those deceptive assets, so access attempts are high-confidence indicators of reconnaissance or lateral movement. Option B (Certificate Trust, File Path, Full Disk Encryption) is correct because Deception is the Zscaler capability built to detect intruders touching internal decoys.
Why the other options are incorrect:
A). Detect Crowdstrike, Crowdstrike ZTA score, First name: CrowdStrike checks can be posture signals when configured, but a user first name is an identity attribute, not device posture.
C). Domain Joined, Process Check, Deception Check: Deception uses decoys, fake credentials, lures, and traps to expose intruders who are exploring the environment.
D). Unauthorized Modification, OS Version, License Key: OS Version is a valid posture-style signal, but unrelated values like license key make that option invalid as a set.