NSK300 Sample Questions Answers

• When a user is on-premises at the enterprise and accesses an application that is IP restricted, the source IP for traffic to this application is the Enterprise Egress IPv4 address.
• The Enterprise Egress IP represents the external IP address of the enterprise network as seen by external services or applications.
• This IP address is used for communication between the user’s device and external resources, including applications that are IP restricted. References:
• The answer is based on general knowledge of networking concepts and how IP addresses are used in enterprise environments.

To provide access to a private application for the Human Resources (HR) users group only after deploying and registering an NPA publisher, you would need to:

• Enable private app steering in the Steering Configuration assigned to the HR group: This ensures that only traffic from the HR user group is steered towards the private application.
• Create a new private app and assign it to the HR user group: This step involves defining the private application within Netskope and specifying that only the HR user group should have access to it.
• Create a new Real-time Protection policy as follows:

By following these steps, you can ensure that only the HR user group has access to the private application, aligning with the principles of least privilege and zero trust access control.

References: The process for providing access to a private application for a specific user group is detailed in Netskope’s documentation on Private Access and Private App Management12.

Fingerprinting would satisfy the requirement to prevent the exfiltration of sensitive Personally Identifiable Information (PII) data by employees and contractors. Fingerprinting is a data protection technique that involves creating a unique digital representation of sensitive data. This allows for the detection of any exact or partial matches of the fingerprinted data leaving the company’s environment, thereby preventing unauthorized data exfiltration.It is particularly effective in scenarios where multiple individuals require access to sensitive data, as it can protect against both inadvertent and malicious attempts to move data outside of authorized channels1.

References: Netskope’s Data Loss Prevention (DLP) capabilities include fingerprinting as a method to secure sensitive data consistently across the enterprise1.The Netskope Knowledge Portal provides further information on how to enable and configure fingerprinting and other DLP settings to protect sensitive PII data2.

To ensure that no data is uploaded to non-AcmeCorp instances of OneDrive, the policies that would accomplish this are:

• Policy B: This policy allows traffic only for AcmeCorp’s OneDrive and blocks all other Microsoft 365 Suite traffic. It ensures that data is not uploaded to non-AcmeCorp OneDrive instances by restricting access to only the corporate instance of OneDrive.
• Policy C: This policy allows traffic for AcmeCorp’s Microsoft 365 Suite but blocks all other OneDrive for Business traffic. It achieves the same outcome by permitting corporate suite usage while preventing uploads to any OneDrive for Business instances that are not part of AcmeCorp.

These policies are designed to provide granular control over the data flow, ensuring that company data remains within the corporate environment and is not transferred to external or personal storage solutions.

References: The policies are based on Netskope’s capabilities for real-time protection and data security, which allow organizations to enforce granular access and control policies. The information aligns with the best practices for setting up such policies as described in Netskope’s documentation and resources

When verifying that Google Drive traffic is being tunneled to Netskope using Chrome and the Netskope Client, you would expect to see log entries indicating that the traffic is being directed through Netskope’s proxy. Specifically, Option A is correct as it shows the process “google drive” being tunneled tonsProxy. The log entry for Option A indicates that a TLS tunneling flow from a local address and process (Google Drive) is being directed to a host(play.googleapis.com) and then to Netskope’s proxy (nsProxy).This is consistent with how Netskope tunnels specified traffic for security and policy enforcement1.

References: The expected log entries are based on the standard operation of Netskope Client and how it steers traffic to Netskope’s cloud services, as detailed in Netskope’s documentation1.

To address the issue of a certificate-pinned application not being accessible due to certificate pinning, while still steering the traffic to Netskope, the two methods that would satisfy the requirements are:

• B: Configure the SSL Do Not Decrypt policy to not decrypt traffic for domains used by the native application. This ensures that the SSL traffic for the specified domains is not decrypted, thus avoiding issues with certificate pinning.
• C: Configure domain exceptions in the steering configuration for the domains used by the native application.By setting domain exceptions, traffic to these domains will bypass SSL decryption, allowing the certificate-pinned application to function as expected1.

These methods are in line with Netskope’s capabilities for handling certificate-pinned applications, which often require bypassing decryption to prevent breaking the application’s functionality due to its security features1.

References: The Netskope Knowledge Portal provides detailed information on managing certificate-pinned applications, including how to configure SSL Do Not Decrypt policies and domain exceptions in the steering configuration1.Additionally, the Netskope Community Forum offers insights and best practices for handling certificate-pinned applications2.

• The issue described in the exhibit is that banking websites are still being inspected despite creating an SSL decryption policy to bypass the inspection of financial and accounting web categories.
• Possible Causes:
• Solution:

The issue is likely caused bya missing group name in the SAML response (A). When access to Microsoft 365 from unmanaged devices is not blocked as expected, despite having a policy in place, it often indicates that the SAML assertion is not correctly identifying the user as a member of the restricted group. In this case, the “marketing-users” group name should be present in the SAML response to enforce the policy that blocks login activity for this group. If the group name is missing, the policy will not apply, and users will not be blocked as intended.

References: This explanation is consistent with the configuration requirements for access control using SAML responses, as detailed in Netskope’s documentation on Reverse Proxy and SAML integration1.

• To retain the original dashboard without automatic updates due to improvements made by Netskope, you can download the desired dashboard and then import it from a file into your Group or Personal folder.
• This approach ensures that you have a static version of the dashboard that won’t be affected by future changes or enhancements. References:
• The answer is based on general knowledge of dashboard management and customization within Netskope.

When deploying Netskope and steering all traffic, if you find that the Real-time Protection policies for Microsoft OneDrive are not being enforced, the likely issue is with the default steering exceptions. To resolve this, you should remove the default steering exception for domains ©. This is because the default exceptions may include domains related to Microsoft services, which could prevent the Real-time Protection policies from being applied to traffic directed towards OneDrive. By removing these exceptions, you ensure that all traffic, including that to OneDrive, is subject to the policies you have set up.

References: This recommendation is based on best practices for configuring Real-time Protection policies in Netskope, as outlined in their documentation, which suggests that exceptions should be carefully managed to ensure that security policies are enforced as intended

When using IPsec tunnels, especially in the context of deploying Netskope for on-premises devices, several factors must be considered to ensure a secure and efficient architecture:

• Cipher support on tunnel-initiating devices (A): It is crucial to ensure that the devices initiating the IPsec tunnels support the ciphers used by Netskope. This compatibility is necessary for establishing secure connections.
• Bandwidth considerations (B): The bandwidth available for the IPsec tunnels will affect the data throughput and performance of the connection. Adequate bandwidth must be allocated to handle the expected traffic without causing bottlenecks.
• The impact of threat scanning performance (D): The performance of threat scanning can be affected by the encryption and decryption processes in IPsec tunnels. It is important to consider how the threat scanning capabilities will perform under the additional load of encrypted traffic.

These elements are essential for the successful implementation of IPsec tunnels in a Netskope architecture plan for on-premises devices12.

References: The considerations for using IPsec tunnels are outlined in the Netskope Knowledge Portal and Community discussions, which provide guidance on deployment and validation of IPsec tunnels, including cipher support, bandwidth management, and maintaining threat scanning performance

In the scenario where CASB traffic steering is enabled using the Netskope Client without a Real-time Protection policy being activated, the default behavior of the traffic is toallow and log it (B). This means that the traffic will not be blocked; instead, it will be permitted to pass through and will be recorded for monitoring and analysis purposes.This default setting ensures visibility into the traffic and user activities without immediately enforcing a block, allowing for a period of observation and policy tuning before potentially more restrictive actions are taken1.

References: The default behavior of traffic steering in Netskope, including the logging of allowed traffic, is detailed in Netskope’s best practices and community discussions on Real-time Protection policies1.

Users from Companies A, B, and C can indeed be provisioned to Netskope. Company A, which uses Active Directory, can continue to use the existing AD Importer. For Company B that uses Azure AD and Company C that uses Okta Universal Directory, integration with SCIM (System for Cross-domain Identity Management) solutions is possible.Netskope supports provisioning users from multiple directories, including Active Directory and cloud-based identity providers like Azure AD and Okta, by using additional AD Importers and integrating more than one SCIM solution12.

References: The correct approach for provisioning users from different companies that use various directory services is supported by Netskope’s capabilities to integrate with multiple identity providers and directory services, as outlined in their documentation and community resources12.

The three potential reasons for the failure of a new user not being provisioned to Netskope an hour after being added to the domain could be:

• B. The server that the Directory Importer is installed on is unable to reach Netskope’s add-on endpoint: If the server cannot connect to Netskope’s endpoint, it cannot sync the user data. This could be due to network issues, incorrect configuration, or firewall restrictions1.
• C. The user is not a member of the group specified as a filter: The Directory Importer may be configured to import users from specific groups only. If the new user is not a member of these groups, they will not be imported into Netskope1.
• E. The default collection interval is 180 minutes, therefore a sync may not have run yet: The Directory Importer may be scheduled to sync every 180 minutes. If only an hour has passed, the sync process might not have occurred yet, and the user would not be provisioned until the next sync interval1.

References: These potential reasons are based on the standard operation and configuration of the Netskope Directory Importer as described in the Netskope Knowledge Portal and documentation

• Admin Role and File Content Viewing: By default, an admin role does not prevent admins from downloading and viewing file content. Admins have access to view and download file content unless specific restrictions are applied.
• Role Privileges Default to Read Only: All role privileges in Netskope default to Read Only for all functional areas. This means that admins can view information but cannot make changes unless explicitly granted additional permissions.
• Obfuscation: Obfuscation can be applied to specific functional areas, but it is not a default behavior for all areas. References:
• Netskope Security Cloud Introductory Online Technical Training
• Netskope Security Cloud Operation & Administration (NSCO&A) - Classroom Training