If 'File Inspection' is enabled in the Web policy, all password protected files are automatically blocked.
Explanation and Workaround
A password-protected archive is not scanned as it cannot be decompressed without the password, however, it will be blocked under the antivirus' Protected Archive category. If there is a scanning error or the file is found to be corrupt or otherwise encrypted, Umbrella blocks that as well.
Workaround for this is to exclude the domain from SSL decryption / disable file inspection, therefore allowing the encrypted archive to download.
To view a list of the files that's potentially blocked in this category, you can login to the Reports section on your Dashboard. The 'Action' column of the Activity Search will report 'Protected Archive' on password-protected files blocked in this category.