New Year Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

Free and Premium Netskope NSK300 Dumps Questions Answers

Page: 1 / 5
Total 68 questions

Netskope Certified Cloud Security Architect Exam Questions and Answers

Question 1

You are already using Netskope CSPM to monitor your AWS accounts for compliance. Now you need to allow access from your company-managed devices running the Netskope Client to only Amazon S3 buckets owned by your organization. You must ensure that any current buckets and those created in the future will be allowed

Which configuration satisfies these requirements?

Options:

A.

Steering: Cloud Apps Only, All Traffic Policy type: Real-time Protection

Constraint: Storage. Bucket Does Not Match -ALLAccounts Action: Block

B.

Steering: Cloud Apps Only Policy type: Real-time Protection

Constraint: Storage. Bucket Does Not Match *@myorganization.com Action: Block

C.

Steering: Cloud Apps Only. All Traffic Policy type: Real-time Protection Constraint: Storage. Bucket Does Match -ALLAccounts Action: Allow

D.

Steering: All Web Traffic Policy type: API Data Protection

Constraint: Storage, Bucket Does Match *@myorganization.com Action: Allow

Buy Now
Question 2

A company needs to block access to their instance of Microsoft 365 from unmanaged devices. They have configured Reverse Proxy and have also created a policy that blocks login activity for the AD group "marketing-users" for the Reverse Proxy access method. During UAT testing, they notice that access from unmanaged devices to Microsoft 365 is not blocked for marketing users.

What is causing this issue?

Options:

A.

There is a missing group name in the SAML response.

B.

The username in the name ID field is not in the format of the e-mail address.

C.

There is an invalid certificate in the SAML response.

D.

The username in the name ID field does not have the "marketing-users" group name.

Question 3

Your client is an NG-SWG customer. They are going to use the Explicit Proxy over Tunnel (EPoT) steering method. They have a specific list of domains that they do not want to steer to the Netskope Cloud.

What would accomplish this task''

Options:

A.

Define exception domains in the PAC file.

B.

Define exceptions in the Netskope steering configuration

C.

Create a real-time policy with a bypass action.

D.

Use an SSL decryption policy.

Question 4

You have an NG-SWG customer that currently steers all Web traffic to Netskope using the Netskope Client. They have identified one new native application on Windows devices that is a certificate-pinned application. Users are not able to access the application due to certificate pinning. The customer wants to configure the Netskope Client so that the traffic from the application is steered to Netskope and the application works as expected.

Which two methods would satisfy the requirements? (Choose two.)

Options:

A.

Bypass traffic using the bypass action in the Real-time Protection policy.

B.

Configure the SSL Do Not Decrypt policy to not decrypt traffic for domains used by the native application.

C.

Configure domain exceptions in the steering configuration for the domains used by the native application.

D.

Tunnel traffic to Netskope and bypass traffic inspection at the Netskope proxy.

Question 5

You are asked to ensure that a Web application your company uses is both reachable and decrypted by Netskope. This application is served using HTTPS on port 6443. Netskope is configured with a default Cloud Firewall configuration and the steering configuration is set for All Traffic.

Which statement is correct in this scenario?

Options:

A.

Create a Firewall App in Netskope along with the corresponding Real-time Protection policy to allow the traffic.

B.

Nothing is required since Netskope is steering all traffic.

C.

Enable "Steer non-standard ports" in the steering configuration and add the domain and port as a new non-standard port

D.

Enable "Steer non-standard ports" in the steering configuration and create a corresponding Real-time Protection policy to allow the traffic

Question 6

Review the exhibit.

You created an SSL decryption policy to bypass the inspection of financial and accounting Web categories. However, you still see banking websites being inspected.

Referring to the exhibit, what are two possible causes of this behavior? (Choose two.)

Options:

A.

The policy is in a "disabled" state.

B.

An incorrect category has been selected

C.

The policy is in a "pending changes" state.

D.

An incorrect action has been specified.

Question 7

You deployed the Netskope Client for Web steering in a large enterprise with dynamic steering. The steering configuration includes a bypass rule for an application that is IP restricted. What is the source IP for traffic to this application when the user is on-premises at the enterprise?

Options:

A.

Loopback IPv4

B.

Netskope data plane gateway IPv4

C.

Enterprise Egress IPv4

D.

DHCP assigned RFC1918 IPv4

Question 8

Review the exhibit.

You installed Directory Importer and configured it to import specific groups ot users into your Netskope tenant as shown in the exhibit. One hour after a new user has been added to the domain, the user still has not been provisioned to Netskope.

What are three potential reasons for this failure? (Choose three.)

Options:

A.

Directory Importer does not support ongoing user syncs; you must manually provision the user.

B.

The server that the Directory Importer is installed on is unable to reach Netskope's add-on endpoint.

C.

The user is not a member of the group specified as a filter

D.

Active Directory integration is not enabled on your tenant.

E.

The default collection interval is 180 minutes, therefore a sync may not have run yet.

Question 9

You are asked to create a customized restricted administrator role in your Netskope tenant for a newly hired employee. Which two statements are correct in this scenario? (Choose two.)

Options:

A.

An admin role prevents admins from downloading and viewing file content by default.

B.

The scope of the data shown in the Ul can be restricted to specific events.

C.

All role privileges default to Read Only for all functional areas.

D.

Obfuscation can be applied to all functional areas.

Question 10

You want to see all instances of malware that were detected by the Netskope Cloud Sandbox.

Which process would you use to achieve this task in the Netskope tenant UI?

Options:

A.

Go to Incidents > Malicious Sites, and perform the detection_engine eq ‘Advanced Detection’ query.

B.

Go to Incidents > Malware and perform the detection_engine eq ‘Netskope Cloud Sandbox’ query.

C.

Go to Skope IT > Alerts, switch to Query Mode and perform the detection_engine eq ‘Netskope Cloud Sandbox’ query.

D.

Go to Skope IT > Page Events, switch to Query Mode and perform the detection_engine eq ‘Netskope Cloud Sandbox’ query.

Question 11

Review the exhibit.

You work for a medical insurance provider. You have Netskope Next Gen Secure Web Gateway deployed to all managed user devices with limited block policies. Your manager asks that you begin blocking Cloud Storage applications that are not HIPAA compliant Prior to implementing this policy, you want to verity that no business or departmental applications would be blocked by this policy.

Referring to the exhibit, which query would you use in the Edit Widget window to narrow down the results?

Options:

A.

app-ccl-compliance-cert neq 'HIPAA' and category eq 'Cloud Storage'

B.

Cloud Confidence Compliance neq HIPAA and Cloud Confidence Category is Cloud Storage

C.

SELECT application WHERE 'HIPAA' NOT IN app-cci-compliance AND WHERE 'Cloud Storage' IN category

D.

app-compliance does not contain HIPAA and category must equal Cloud Storage

Question 12

Review the exhibit.

You are asked to integrate Netskope with Crowdstrike EDR. You added the Remediation profile shown in the exhibit.

Which action will this remediation profile take?

Options:

A.

The endpoint will be isolated.

B.

The malware hash will be added as an IOC in Crowdstrike.

C.

The malware will be quarantined.

D.

The malware hash will be added as an IOC in Netskope.

Question 13

A recent report states that users are using non-sanctioned Cloud Storage platforms to share data Your CISO asks you for a list of aggregated users, applications, and instance IDs to increase security posture

Which Netskope tool would be used to obtain this data?

Options:

A.

Advanced Analytics

B.

Behavior Analytics

C.

Applications in Skope IT

D.

Cloud Confidence Index (CCI)

Question 14

You configured a pair of IPsec funnels from the enterprise edge firewall to a Netskope data plane. These tunnels have been implemented to steer traffic for a set of defined HTTPS SaaS applications accessed from end-user devices that do not support the Netskope Client installation. You discover that all applications steered through this tunnel are non-functional.

According to Netskope. how would you solve this problem?

Options:

A.

Restart the tunnel to stop the tunnel from flapping.

B.

Downgrade from IKE v2 to IKE v1.

C.

Install the Netskope root and intermediate certificates on the end-user devices.

D.

Disable Perfect Forward Secrecy on the tunnel configuration.

Question 15

You are deploying the Netskope Client in a multi-user VDI environment and need to determine the command to deploy the MSI.

Which three parameters are required in this scenario? (Choose three.)

Options:

A.

mode=peruserconfig

B.

host=

C.

installmode=IDP

D.

token=

E.

autoupdate=on

Question 16

Review the exhibit.

Netskope has been deployed using Cloud Explicit Proxy and PAC files. Authentication using Active Directory Federation Services (ADFS) has been configured for SAML Forward Proxy auth. When the users open their browser and try to go to a site, they receive the error shown in the exhibit.

What is a reason for this error?

Options:

A.

The group attribute was not set in the Netskope SAML Forward Proxy configuration.

B.

The Netskope nsauth proxy cannot reach the identity provider.

C.

Netskope is not compatible with the identity provider.

D.

There is an issue with the formatting of the ADFS certificate that was uploaded to the Netskope tenant for SAML Forward Proxy configuration.

Question 17

You are designing a Netskope deployment for a company with a mixture of endpoints, devices, and services.

In this scenario, what would be two considerations for using IPsec as part of the design? (Choose two.)

Options:

A.

guest Wi-Fi network users

B.

corporate-managed Mac computers

C.

remote unmanaged Windows PCs

D.

Internet-connected IoT devices

Question 18

What is a Fast Scan component of Netskope Threat Detection?

Options:

A.

Heuristic Analysis

B.

Machine Learning

C.

Dynamic Analysis

D.

Statical Analysis

Question 19

You are asked to create a Real-time Protection policy to inspect outbound e-mail for DLP violations. You must prevent sensitive e-mail from leaving the corporate mail relay.

In this scenario, which Real-time Protection policy action must be specified?

Options:

A.

Alert

B.

Block

C.

Forward to Proxy

D.

Add SMTP Header

Question 20

You want to verify that Google Drive is being tunneled to Netskope by looking in the nsdebuglog file. You are using Chrome and the Netskope Client to steer traffic. In this scenario, what would you expect to see in the log file?

A)

B)

C)

D)

Options:

A.

Option A

B.

Option B

C.

Option C

D.

Option D

Page: 1 / 5
Total 68 questions