A financial services company is implementing Netskope Private Access (NPA) to provide Zero Trust access to internal applications. The security architect wants to ensure that access to the internal financial modeling application, hosted at 10.10.50.100, is only granted to users in the 'Finance-Quant' Active Directory group who are connecting from corporate-managed devices. Which combination of configurations is required to enforce this specific access policy?
Answer and explanation
Correct answer: B
To correctly enforce this granular access control for NPA, a single Real-time Protection policy is the appropriate mechanism. The policy must define the Private App as the destination and use the 'Source' criteria to specify both the required User Group ('Finance-Quant') and the Device Classification profile for corporate-managed devices. Combining these criteria in one policy ensures that all conditions must be met for access to be granted. Other options incorrectly separate the logic or apply it in the wrong policy type.
Question 2
Multiple answers
A healthcare organization uses Netskope for SaaS Security Posture Management (SSPM) to monitor its Microsoft 365 environment. A security analyst needs to create a policy that continuously checks for publicly shared SharePoint sites containing files classified with the 'PHI' (Protected Health Information) tag. Which TWO components are essential to build this SSPM policy? (Select TWO)
Answer and explanation
Correct answers: A, C
Question 3
A consultant is configuring Netskope's Cloud Threat Exchange (CTE) to share Indicators of Compromise (IOCs) with a third-party EDR solution. The goal is to automate the process of blocking malicious file hashes detected by Netskope across all endpoints. After configuring the CTE plugin for the EDR, the consultant observes that new malicious hashes identified by Netskope are not being shared. What is the most likely misconfiguration?
Answer and explanation
Correct answer: B
Cloud Threat Exchange operates on a publish/subscribe model. Simply configuring a plugin is not enough; a 'Sharing Configuration' must be created to define the flow of intelligence. This configuration specifies which source (e.g., Netskope) shares which type of IOCs (e.g., file hashes) with which destination (the EDR plugin). A missing or incorrect sharing configuration is the most common reason for IOCs not being distributed.
Question 4
True or False: When using Netskope's document fingerprinting for a DLP profile, the system creates and stores a hash of the entire document, which is then used for matching.
Answer and explanation
Correct answer: B
This statement is false. Document fingerprinting does not hash the entire file. Instead, it analyzes the document's content and creates multiple, smaller hashes of overlapping text chunks. This method allows for the detection of partial matches, such as when a user copies and pastes a sensitive paragraph into a new document, making it more robust than a simple full-file hash.
Question 5
Company Background: Global Finance Inc. is a multinational investment firm that has recently adopted a cloud-first strategy, migrating most of its collaboration tools to Microsoft 365 and using Salesforce as its primary CRM. The company has a strict regulatory requirement to prevent the exfiltration of sensitive client financial data and personally identifiable information (PII).
Current Situation: The firm has deployed the Netskope client to all corporate laptops for inline inspection of cloud traffic. They have also configured an API connection to their Microsoft 365 tenant for out-of-band scanning. A recent audit revealed that employees are using personal, unsanctioned cloud storage services (like Dropbox and Mega) to exfiltrate sensitive financial spreadsheets. Furthermore, there is a concern that users are sharing sensitive data from the corporate Salesforce instance with personal email addresses via 'Share' activities.
Requirements:
Block all uploads to any cloud storage application category except for the sanctioned corporate OneDrive for Business instance.
Prevent users from sharing any Salesforce record that contains more than 10 unique customer PII patterns (e.g., SSNs, credit card numbers) with any external email domain.
All policy violations must generate a high-severity alert and be logged to the corporate SIEM.
The solution must be implemented with minimal disruption to legitimate business activities.
Which solution design BEST meets all stated requirements?
Answer and explanation
Correct answer: C
This solution correctly addresses all requirements. It uses policy exceptions to allow sanctioned behavior while blocking the broader category, which is a best practice. It correctly applies a real-time DLP policy to the Salesforce 'Share' activity to prevent data exfiltration as it happens. Finally, it mentions the Log Shipper for SIEM integration, which is the correct component for forwarding logs. Other options either fail to block the activity correctly, use the wrong policy type (e.g., API protection for a real-time activity), or do not meet all requirements.
Question 6
A system administrator is reviewing the Netskope steering configuration for a new deployment. The goal is to ensure all web traffic from managed endpoints is inspected, regardless of whether the user is in the office or remote. The office network is 192.168.1.0/24. Which configuration mode for the Netskope client would be most appropriate?
Answer and explanation
Correct answer: B
'All Traffic' mode is the simplest and most effective way to ensure all web traffic from the client is steered to the Netskope cloud for inspection, regardless of the user's location. While 'On-Premises Detection' could be used, it adds unnecessary complexity if the goal is to inspect all traffic universally. 'All Traffic' mode ensures consistent policy enforcement for both on-premises and remote users.
Question 7
During a security audit, an analyst discovers that several users have been granted excessive permissions within the company's AWS environment, violating the principle of least privilege. The company wants to use Netskope to continuously monitor for and alert on IAM users who have administrative-level permissions. Which Netskope feature should be used to accomplish this?
Answer and explanation
Correct answer: B
Cloud Security Posture Management (CSPM) is the Netskope feature designed specifically to assess the configuration and security posture of IaaS environments like AWS. CSPM policies can be configured to check for specific misconfigurations, such as IAM users with administrative privileges, and generate alerts based on predefined or custom compliance rules.
Question 8
A security team is investigating an alert from Netskope Advanced Analytics indicating an unusually high volume of data has been downloaded from a sanctioned cloud application by a user. This activity is anomalous compared to the user's established baseline. What is the name of the feature within Netskope that provides this type of behavior-based threat detection?
Answer and explanation
Correct answer: C
User and Entity Behavior Analytics (UEBA) is the core feature that establishes baseline behaviors for users and entities and then detects deviations or anomalies from those baselines. An unusually large download is a classic example of an anomaly that UEBA is designed to identify as a potential threat.
Question 9
An administrator needs to create a DLP policy to prevent the upload of source code files to any cloud application. The policy should identify files with extensions like .py, .java, and .cpp. What is the most direct way to define the data to be protected in the DLP profile?
Answer and explanation
Correct answer: C
While regex or dictionaries could potentially identify source code by content, the most direct and efficient method to target specific file types based on their extension is to use a File Profile. The administrator can create a File Profile that lists the extensions (.py, .java, .cpp) and then associate this profile with the DLP rule.
Question 10
A company is using Netskope Remote Browser Isolation (RBI) to protect users browsing high-risk websites. A user reports that they are unable to copy and paste text from an isolated website into a local application. What RBI policy setting most likely needs to be adjusted to allow this functionality?
Answer and explanation
Correct answer: C
Netskope RBI policies include specific 'Data protection controls' that govern user interactions within an isolated session. These controls include options to allow or disallow copy/paste, printing, and file uploads/downloads. To enable copy and paste, the administrator must explicitly enable it within the data protection settings of the applicable RBI policy.
