Exam ZDTE Topic 1 Question 21 Discussion

Zscaler's Digital Transformation material is very clear that third-party admins, vendors, and contractors needing temporary, high-privilege access from unmanaged devices are a primary use case for Privileged Remote Access (PRA). PRA is built on ZPA and delivers a clientless remote desktop gateway: contractors simply use an HTML5-capable browser to reach RDP, SSH, or similar consoles without installing an agent or being placed on the internal network.
The study content explains that PRA enforces least-privilege access on a per-application or per-system basis, with capabilities such as time-bound access windows, credential vaulting/mapping (so credentials are never exposed), and full session recording and monitoring for audit and compliance. This directly matches the scenario of a short-term maintenance task from a contractor's own laptop.
By contrast, SD-WAN, Branch Connector, and Cloud Connector are connectivity constructs for sites and workloads, not for granting interactive, privileged access to individual admins on unmanaged endpoints. They don't solve the governance, session control, and just-in-time access requirements highlighted in the ZDTE content for third-party access. Therefore, Zscaler positions Privileged Remote Access as the correct and recommended approach here.