NSK300 Exam Dumps : Netskope Certified Cloud Security Architect Exam

In the exhibit, the Malware Remediation Profile is configured with:

Connected EDR Server: crowdstrike-demo

Selected Action: Add to watchlist/blocklist

Not Selected: Isolate, Alert

When using CrowdStrike as an EDR integration, the action “Add to watchlist/blocklist” corresponds to:

➡️ Adding the malware hash as an Indicator of Compromise (IOC) inside CrowdStrike Falcon.

CrowdStrike will then block or flag that hash across all managed endpoints, depending on its local policies.

The issue is likely caused by a missing group name in the SAML response (A). When access to Microsoft 365 from unmanaged devices is not blocked as expected, despite having a policy in place, it often indicates that the SAML assertion is not correctly identifying the user as a member of the restricted group. In this case, the “marketing-users” group name should be present in the SAML response to enforce the policy that blocks login activity for this group. If the group name is missing, the policy will not apply, and users will not be blocked as intended.