NSK200 Sample Questions & Answers

'All Traffic' mode is the simplest and most effective way to ensure all web traffic from the client is steered to the Netskope cloud for inspection, regardless of the user's location. While 'On-Premises Detection' could be used, it adds unnecessary complexity if the goal is to inspect all traffic universally. 'All Traffic' mode ensures consistent policy enforcement for both on-premises and remote users.

Cloud Security Posture Management (CSPM) is the Netskope feature designed specifically to assess the configuration and security posture of IaaS environments like AWS. CSPM policies can be configured to check for specific misconfigurations, such as IAM users with administrative privileges, and generate alerts based on predefined or custom compliance rules.

User and Entity Behavior Analytics (UEBA) is the core feature that establishes baseline behaviors for users and entities and then detects deviations or anomalies from those baselines. An unusually large download is a classic example of an anomaly that UEBA is designed to identify as a potential threat.

While regex or dictionaries could potentially identify source code by content, the most direct and efficient method to target specific file types based on their extension is to use a File Profile. The administrator can create a File Profile that lists the extensions (.py, .java, .cpp) and then associate this profile with the DLP rule.

Netskope RBI policies include specific 'Data protection controls' that govern user interactions within an isolated session. These controls include options to allow or disallow copy/paste, printing, and file uploads/downloads. To enable copy and paste, the administrator must explicitly enable it within the data protection settings of the applicable RBI policy.

The 'Make Private' remediation action leverages the SaaS application's native API to modify the sharing settings of a file. It is designed to remove permissions for external users or disable public links, effectively reverting the file's access level to be private to the owner or restricted to internal collaborators, thus mitigating exposure.

Certificate pinning is a security mechanism where an application is designed to only accept a specific, pre-defined server certificate or public key. When Netskope performs SSL decryption, it presents its own certificate to the client. A pinned application will detect this mismatch, reject the connection, and cause the application to fail. The solution is to create an exception to not decrypt traffic for this application.

This statement is false. The Netskope Cloud Exchange (CTE) is a software-based solution that is deployed as a virtual machine (VM) within the customer's environment (e.g., VMware, AWS, Azure, GCP). It does not require a physical appliance.

The 'Isolate' action invokes Netskope's Remote Browser Isolation (RBI). This renders the website in a disposable container in the Netskope cloud and streams a safe, interactive visual feed to the user's browser. It allows the user to interact with the site's content fully, but no active code from the website ever reaches the endpoint, providing robust protection against web-based malware.