2024 Easy Success Netskope NSK200 Exam in First Try [Q15-Q29]

2024 一回目の試験でNetskope NSK200に簡単に合格【Q15-Q29

8月 9, 2024 管理者 0 コメント

4/5 - (1 投票)

2024 Easy Success Netskope NSK200 Exam in First Try

Best NSK200 Exam Dumps for the Preparation of Latest Exam Questions

Q15. Your company needs to keep quarantined files that have been triggered by a DLP policy. In this scenario, which statement Is true?

The files are stofed remotely In your data center assigned In the Quarantine profile.

The files are stored In the Netskope data center assigned in the Quarantine profile.

The files are stored In the Cloud provider assigned In the Quarantine profile.

The files are stored on the administrator console PC assigned In the Quarantine profile.

説明
When a policy flags a file to be quarantined, that file is placed in a quarantine folder and a tombstone file is put in the original location in its place. The quarantine folder is located in the Netskope data center assigned in the Quarantine profile. The Quarantine profile is configured in Settings > Threat Protection > API-enabled Protection. The quarantined file is zipped and protected with a password to prevent users from inadvertently downloading the file. Netskope then notifies the admin specified in the profile1. Therefore, option B is correct and the other options are incorrect. References: Quarantine – Netskope Knowledge Portal, Threat Protection – Netskope Knowledge Portal

Q16. You notice that your Netskope client icon has a red dot and see “Disabled due to error” when hovering the mouse over the icon. What are two reasons for this message? (Choose two.)

The client service is manually stopped.

The steering exceptions are incorrect.

The client health check has failed.

The client traffic is directed over iPsec.

説明
Two reasons for the message “Disabled due to error” when hovering the mouse over the Netskope client icon are A. The client service is manually stopped and C. The client health check has failed. The client service is a background process that runs the Netskope client on the user’s device and communicates with the Netskope cloud. If the client service is manually stopped by the user or by another program, the Netskope client will be disabled and show a red dot on the icon1. The client health check is a feature that monitors the status of the Netskope client and performs self-repair actions if any issues are detected. If the client health check has failed, it means that the Netskope client has encountered a critical error that cannot be fixed automatically, such as corrupted files or registry entries. In this case, the Netskope client will be disabled and show a red dot on the icon2. Therefore, options A and C are correct and the other options are incorrect. References: Troubleshooting Netskope Client – Netskope Knowledge Portal, Client Health Check – Netskope Knowledge Portal

Q17. A customer wants to use Netskope to prevent PCI data from leaving the corporate sanctioned OneDrive instance. In this scenario. which two solutions would assist in preventing data exfiltration? (Choose two.)

API Data Protection

Cloud Firewall (CFW)

SaaS Security Posture Management (SSPM)

Real-time Protection

説明
To prevent PCI data from leaving the corporate sanctioned OneDrive instance, the customer can use API Data Protection and Real-time Protection. API Data Protection is a feature that allows you to discover, classify, and protect data that is already resident in your cloud services, such as OneDrive. You can create a policy that matches the PCI data based on criteria such as users, content, activity, or DLP profiles. Then, you can choose an action to prevent the PCI data from being shared or exfiltrated, such as remove external collaborators, remove public links, or quarantine3. Real-time Protection is a feature that allows you to inspect and control data in transit between your users and cloud services, such as OneDrive. You can create a policy that matches the PCI data based on criteria such as users, devices, locations, categories, or DLP profiles. Then, you can choose an action to prevent the PCI data from being uploaded or downloaded, such as block, alert, encrypt, or watermark4. Therefore, options A and D are correct and the other options are incorrect. References: API Data Protection – Netskope Knowledge Portal, Real-time Protection – Netskope Knowledge Portal

Q18. You want to secure Microsoft Exchange and Gmail SMTP traffic for DLP using Netskope. Which statement is true about this scenario when using the Netskope client?

Netskope can inspect outbound SMTP trafficfor Microsoft Exchange and Gmail.

Enable Cloud Firewall to Inspect Inbound SMTP traffic for Microsoft Exchange and Gmail.

Netskope can inspect inbound and outbound SMTP traffic for Microsoft Exchange and Gmail.

Enable REST API v2 to Inspect inbound SMTP traffic for Microsoft Exchange and Gmail.

説明
Netskope can inspect outbound SMTP traffic for Microsoft Exchange and Gmail using the Netskope client.
The Netskope client intercepts the SMTP traffic from the user’s device and forwards it to the Netskope cloud for DLP scanning. The Netskope client does not inspect inbound SMTP traffic, as this is handled by the cloud email service or the MTA. Therefore, option A is correct and the other options are incorrect. References: Configure Netskope SMTP Proxy with Microsoft O365 Exchange, Configure Netskope SMTP Proxy with Gmail, SMTP DLP, Best Practices for Email Security with SMTP proxy

Q19. Your learn is asked to Investigate which of the Netskope DLP policies are creating the most incidents. In this scenario, which two statements are true? (Choose two.)

The Skope IT Applications tab will list the top five DLP policies.

You can see the top Ave DLP policies triggered using the Analyze feature

You can create a report using Reporting or Advanced Analytics.

The Skope IT Alerts tab will list the top five DLP policies.

説明
To investigate which of the Netskope DLP policies are creating the most incidents, the following two statements are true:
You can see the top five DLP policies triggered using the Analyze feature. The Analyze feature allows you to create custom dashboards and widgets to visualize and explore your data. You can use the DLP Policy widget to see the top five DLP policies that generated the most incidents in a given time period3.
You can create a report using Reporting or Advanced Analytics. The Reporting feature allows you to create scheduled or ad-hoc reports based on predefined templates or custom queries. You can use the DLP Incidents by Policy template to generate a report that shows the number of incidents per DLP policy4. TheAdvanced Analytics feature allows you to run SQL queries on your data and export the results as CSV or JSON files. You can use the DLP_INCIDENTS table to query the data by policy name and incident count5.
The other two statements are not true because:
The Skope IT Applications tab will not list the top five DLP policies. The Skope IT Applications tab shows the cloud app usage and risk summary for your organization. It does not show any information about DLP policies or incidents6.
The Skope IT Alerts tab will not list the top five DLP policies. The Skope IT Alerts tab shows the alerts generated by various policies and profiles, such as DLP, threat protection, IPS, etc. It does not show the number of incidents per policy, only the number of alerts per incident7.

Q20. Recently your company implemented Zoom for collaboration purposes and you are attempting to inspect the traffic with Netskope. Your initial attempt reveals that you are not seeing traffic from the Zoom client that is used by all users. You must ensure that this traffic is visible to Netskope.
In this scenario, which two steps must be completed to satisfy this requirement? (Choose two.)

Create a steering exception for Zoom to ensure traffic is reaching Netskope.

Create a Do Not Decrypt SSL policy for the Zoom application suite.

Remove the Zoom certificate-pinned application from the default steering configuration.

Remove the default steering exception for the Web Conferencing Category.

説明
To ensure that the traffic from the Zoom client is visible to Netskope, you need to remove the Zoom certificate-pinned application from the default steering configuration and remove the default steering exception for the Web Conferencing Category. A certificate-pinned application is an application that validates the server certificates against the hardcoded ones in the application. This is a security technique used to prevent man-in-the-middle attacks and secure access to the application. By default, Netskope bypasses the traffic from certificate-pinned applications and does not decrypt or inspect it3. Zoom is one of the predefined certificate-pinned applications that Netskope supports4. To enable Netskope to inspect the traffic from Zoom, you need to remove it from the steering configuration that applies to your users5. Additionally, you need to remove the default steering exception for the Web Conferencing Category, which includes Zoom and other similar applications. A steering exception is a rule that specifies the traffic that you want to bypass Netskope and go directly to the destination6. By removing this exception, you allow Netskope to steer and analyze the traffic from web conferencing applications. Therefore, options C and D are correct and the other options are incorrect. References: Certificate Pinned Applications – Netskope Knowledge Portal, Certificate Pinned App (CPA) – The Netskope Community, Steering Configuration – Netskope Knowledge Portal, Steering Exceptions
– Netskope Knowledge Portal

Q21. Your company has a Symantec BlueCoat proxy on-premises and you want to deploy Netskope using proxy chaining. Which two prerequisites need to be enabled first in this scenario? (Choose two.)

Disable SSL decryption.

Disable the X-Authenticated-User header.

Enable SSL decryption.

Enable the X-Forwarded-For HTTP header

説明
To deploy Netskope using proxy chaining with Symantec BlueCoat proxy on-premises, you need to enable two prerequisites first: Enable SSL decryption on your Symantec BlueCoat proxy. This is required for proxy chaining because Netskope needs to inspect the SSL traffic that is sent from your proxy to the Netskope cloud.
To enable SSL decryption, you need to configure your Symantec BlueCoat proxy to trust the Netskope certificate for SSL interception. You can download the certificate from Settings > Manage > Certificates > Signing CA in the Netskope UI. Enable the X-Forwarded-For HTTP header on your Symantec BlueCoat proxy. This is required for proxy chaining because Netskope needs to identify the original source IP address of the user behind your proxy. The X-Forwarded-For header is used to pass this information from your proxy to Netskope. To enable this header, you need to configure your Symantec BlueCoat proxy to send X-Forwarded-For HTTP header for all HTTP requests. The other options are not valid prerequisites for this scenario. You do not need to disable SSL decryption on your Symantec BlueCoat proxy, as this would prevent Netskope from inspecting the SSL traffic. You do not need to disable the X-Authenticated-User header on your Symantec BlueCoat proxy, as this is an optional header that can be used to pass additional user information from your proxy to Netskope. References: Proxy Chaining3, Configure Forcepoint for Proxy Chaining

Q22. Your customer currently only allows users to access the corporate instance of OneDrive using SSO with the Netskope client. The users are not permitted to take their laptops when vacationing, but sometimes they must have access to documents on OneDrive when there is an urgent request. The customer wants to allow employees to remotely access OneDrive from unmanaged devices while enforcing DLP controls to prohibit downloading sensitive files to unmanaged devices.
Which steering method would satisfy the requirements for this scenario?

Use a reverse proxy integrated with their SSO.

Use proxy chaining with their cloud service providers integrated with their SSO.

Use a forward proxy integrated with their SSO.

Use a secure forwarder integrated with an on-premises proxy.

説明
A reverse proxy integrated with their SSO would satisfy the requirements for this scenario. A reverse proxy intercepts requests from users to cloud apps and applies policies based on user identity, device posture, app, and data context. It can enforce DLP controls to prohibit downloading sensitive files to unmanaged devices. It can also integrate with the customer’s SSO provider to authenticate users and allow access only to the corporate instance of OneDrive.The other steering methods are not suitable for this scenario because they either require the Netskope client or do not provide granular control over cloud app activities.

Q23. The risk team at your company has determined that traffic from the sales team to a custom Web application should not be inspected by Netskope. All other traffic to the Web application should continue to be inspected.
In this scenario, how would you accomplish this task?

Create a Do Not Decrypt Policy using User Group and Domainin the policy page.

Create a Do Not Decrypt Policy using Application in the policy page and a Steering Exception for Group

Create a Do Not Decrypt Policy using Destination IP and Application in the policy page.

Create a Do Not Decrypt Policy using Source IP and Application in the policy page.

説明
To prevent traffic from the sales team to a custom Web application from being inspected by Netskope, you need to create a Do Not Decrypt Policy using User Group and Domain in the policy page. A Do Not Decrypt Policy allows you to specify the traffic you want to leave encrypted and not further analyzed by Netskope via the Real-time Protection policies3. You can use the User Group criteria to match the sales team members and the Domain criteria to match the custom Web application. This way, only the traffic from the sales team to the custom Web application will be exempted from decryption, while all other traffic to the Web application will continue to be inspected.

Q24. What is the purpose of the filehash list in Netskope?

It configures blocklist and allowlist entries referenced in the custom Malware Detection profiles.

It provides the file types that Netskope can inspect.

It is used to allow and block URLs.

It providesClient Threat Exploit Prevention (CTEP).

説明
The purpose of the file hash list in Netskope is to configure blocklist and allowlist entries referenced in the custom Malware Detection profiles. A file hash list is a collection of MD5 or SHA-256 hashes that represent files that you want to allow or block in your organization. You can create a file hash list when adding a file profile and use it as an allowlist or blocklist for files in your organization1. You can then select the file hash list when creating a Malware Detection profile2.

Q25. Your company has Microsoft Azure ADFS set up as the Identity Provider (idP). You need to deploy the Netskope client to all company users on Windows laptops without user intervention.
In this scenario, which two deployment options would you use? (Choose two.)

Deploy the Netskope client with SCCM.

Deploy the Netskope client with Microsoft GPO.

Deploy the Netskope client using IdP.

Deploy the Netskope client using an email Invitation.

説明
To deploy the Netskope client to all company users on Windows laptops without user intervention, you can use either SCCM or GPO. These are two methods of packaging the application and pushing it silently to the user’s device using Microsoft tools4. These methods donot require the user to have local admin privileges or to initiate the installation themselves. They also allow enforcing the use of the client through company policy. The Netskope client can authenticate the user using Azure ADFS as the identity provider, as long as the UPN of the logged in user matches the directory5

Q26. Review the exhibit.

What is the purpose ofthe configuration page shown Iithe exhibit?

to provision a Netskope client using SCCM

to allow users to authenticate against the proxy

to onboard Active Directory users to a Netskope tenant

to enforce administrative role-based access

説明
The configuration page shown in the exhibit is used to onboard Active Directory users to a Netskope tenant.
This is done by configuring the Active Directory settings in the Netskope platform and then importing the users from Active Directory. The configuration page allows you to specify the following parameters:
Directory Service: The type of directory service that you are using, such as Active Directory or LDAP.
Domain Name: The name of your Active Directory domain, such as example.com.
Domain Controller: The IP address or hostname of your Active Directory domain controller, such as dc1.example.com.
Username: The username of an account that has read access to your Active Directory, such as administrator@example.com.
Password: The password of the account that has read access to your Active Directory.
Base DN: The base distinguished name of the container or organizational unit that contains the users and groups that you want to import, such as OU=Users,DC=example,DC=com.
User Filter: The LDAP filter that defines the criteria for selecting the users that you want to import, such as (objectClass=user).
Group Filter: The LDAP filter that defines the criteria for selecting the groups that you want to import, such as (objectClass=group).
After configuring these parameters, you can click on Test Connection to verify that the connection to your Active Directory is successful. Then you can click on Import Users to start importing the users and groups from your Active Directory to your Netskope tenant.
References: Onboarding Active Directory Users to a Netskope Tenant1

Q27. Review the exhibit.

You are asked to restrict users from accessing YouTube content tagged as Sport. You created the required real-time policy; however, users can still access the content Referring to the exhibit, what is the problem?

The website is in a steering policy exception.

The policy changes have not been applied.

The YouTube content cannot be controlled.

The traffic matched a Do Not Decrypt policy

説明
The problem in this scenario is that the traffic matched a Do Not Decrypt policy. A Do Not Decrypt policy is a rule that specifies the traffic that you want to leave encrypted and not further analyzed by Netskope via the Real-time Protection policies1. In the exhibit, we can see that the traffic from the user to YouTube has a
“Bypass Traffic” value of “yes” and a “Netskope” value of “yes”. This means that the traffic was steered to Netskope but not decrypted or inspected2. Therefore, the real-time policy that was created to restrict users from accessing YouTube content tagged as Sport did not apply, and users could still access the content. To solve this problem, you need to either remove or modify the Do Not Decrypt policy that matches the traffic to YouTube, or create an exception for the Sport category in the policy3. Therefore, option D is correct and the other options are incorrect. References: Page Events – Netskope Knowledge Portal, Add a Policy for SSL Decryption – Netskope Knowledge Portal, YouTube Content Control – Netskope Knowledge Portal

Q28. Netskope is being used as a secure Web gateway. Your organization’s URL list changes frequently. In this scenario, what makes It possible for a mass update of the URL list in the Netskope platform?

REST API v2

Assertion Consumer Service URL

Cloud Threat Exchange

SCIM provisioning

説明
The method that makes it possible for a mass update of the URL list in the Netskope platform is A. REST API v2. REST API v2 is a feature that allows you to use an auth token to make authorized calls to the Netskope API and access resources via URI paths5. You can use REST API v2 to update a URL list with new values by providing the name of an existing URL list and a comma-separated list of URLs or IP addresses6. This can help you automate or script the management of your URL lists and keep them up-to-date. Therefore, option A is correct and the other options are incorrect. References: REST API v2 Overview – Netskope Knowledge Portal, Update a URL List – Netskope Knowledge Portal

Q29. You are having issues with fetching user and group Information periodically from the domain controller and posting that information to your tenant instance in the Netskope cloud. To begin the troubleshooting process, what would you Investigate first in this situation?

On-Premises Log Parser

Directory Importer

DNS Connector

AD Connector

説明
The Directory Importer is a component of the Netskope Adapters that connects to the domain controller and periodically fetches user and group information to post that info to your tenant instance in the Netskope cloud1. If you are having issues with this process, the first thing you should investigate is the Directory Importer itself. You can check the status of the Directory Importer service, the configuration file, the logs, and the connectivity to the domain controller and the Netskope cloud2. Therefore, option B is correct and the other options are incorrect. References: Configure Directory Importer – Netskope Knowledge Portal, Troubleshooting Directory Importer – Netskope Knowledge Portal

ローディング …