Question 1

A company is attempting to steer traffic to Netskope using GRE tunnels. They notice that after the
initial configuration, users cannot access external websites from their browsers.
What are three probable causes for this issue? (Choose three.)

Accepted Answer

B, C, D

Explanation: The inability for users to access external websites after configuring a GRE tunnel to Netskope points to a fundamental failure in tunnel establishment, connectivity, or traffic routing. The three most probable causes are: 1. Incorrect Peer Configuration (B): The GRE tunnel is a point-to-point link. If the source IP address of the corporate network device is not correctly registered as the peer in the Netskope platform, Netskope will not accept the tunnel, causing a complete failure. 2. Firewall Blockage (C): GRE uses IP Protocol 47. Corporate firewalls often restrict outbound traffic to well-known protocols like TCP and UDP by default. If the firewall is not explicitly configured to permit Protocol 47 to Netskope's data centers, the tunnel packets will be dropped. 3. Incorrect Routing (D): Policy-Based Routing (PBR), often implemented with route maps, is required to direct user traffic into the GRE tunnel. If this policy is misconfigured or applied to the wrong interface, traffic will not be steered to Netskope, leading to a loss of access if direct internet paths are otherwise restricted.

Question 2

Click the Exhibit button. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Netspoke_NSK101/page_106_img_1.jpg A user is uploading a file containing PCI-DSS data to the corporate Google Drive instance. You notice that the upload is not blocked by the policy shown in the exhibit. Which statement is correct in this scenario?

Accepted Answer

C

Explanation: The policy is correctly configured with the specific application (Google Drive), activity (Upload), data pattern (PCI-DSS), and action (Block) to prevent the described data exfiltration. Given that the policy's components are correct, the failure to block the upload indicates an issue with the policy evaluation sequence. Netspoke security policies are processed in a sequential, top-down order. The traffic is being allowed because a more general "allow" policy (e.g., "Allow Google Drive" or "Allow Cloud Storage") is positioned before this specific "block" policy in the rule base. The first rule that matches the traffic is applied, and subsequent rules are ignored.

Question 3

You want to use an out-of-band API connection into your sanctioned Microsoft 365 OneDrive for
Business application to find sensitive content, enforce near real-time policy controls, and quarantine
malware.
In this scenario, which primary function in the Netskope platform would you use to connect your
application to Netskope?

Accepted Answer

D

Explanation: The scenario requires an out-of-band API connection to a sanctioned SaaS application (Microsoft 365 OneDrive) for scanning data-at-rest, enforcing policies, and threat protection. Netskope's SaaS API-enabled Protection is the specific function designed for this purpose. It directly integrates with the SaaS application's API to provide visibility and control over data and threats without being in the real-time traffic path. This allows for retrospective scanning of all existing data and near real-time enforcement on new or modified files.

Question 4

You want to deploy Netskope's zero trust network access (ZTNA) solution, NP

Accepted Answer

C

Explanation: Netskope Private Access (NPA) is a Zero Trust Network Access (ZTNA) solution that functions by steering traffic for specific private applications from a user's device through the Netskope Security Cloud. The fundamental action to enable this service is to configure a traffic steering policy. Within the Netskope admin console, an administrator must create or edit a steering configuration and explicitly enable the option to "Steer all Private Apps." This instructs the Netskope Client, installed on endpoints, to intercept and tunnel traffic destined for the defined private applications, thereby deploying the core ZTNA functionality.

Question 5

What correctly defines the Zero Trust security model?

Accepted Answer

A

Explanation: The Zero Trust security model is fundamentally defined by the principle of least privilege access. Its core tenet is "never trust, always verify," meaning no user or device is trusted by default, regardless of its location on the network. Access to resources is granted on a per-session basis and is strictly limited to the minimum necessary for the task. While components like strong authentication and layered security are used to implement Zero Trust, the defining strategic principle is the enforcement of least privilege to minimize the attack surface and limit lateral movement in the event of a breach.

Question 6

You investigate a suspected malware incident and confirm that it was a false alarm.

Accepted Answer

D

Explanation: After an investigation confirms a malware alert is a false positive, the primary goal is to prevent the same benign file from triggering future alerts, a process known as tuning. Adding the file's unique cryptographic hash (e.g., SHA-256) to a filter, exclusion list, or allow list is the most precise and secure method. This instructs the security system to recognize and trust this specific file in the future, effectively suppressing recurrent false alarms without broadly weakening security policies. This action directly resolves the issue without disrupting the availability of a legitimate file.

Question 7

Which two cloud security and infrastructure enablement technologies does Secure Access Service Edge (SASE) combine into its unified platform? (Choose two.)

Accepted Answer

B, C

Explanation: Secure Access Service Edge (SASE) is a cloud-native architecture that converges network and security services into a single, unified platform. The security pillar of SASE, often referred to as the Security Service Edge (SSE), integrates several core technologies. Among these, Zero Trust Network Access (ZTNA) is fundamental for providing secure, identity-based access to private applications, replacing traditional VPNs. Cloud Access Security Broker (CASB) is another essential component, offering visibility, data security, and threat protection for cloud applications (SaaS). Together, ZTNA and CASB are foundational security technologies that SASE combines to secure users, devices, and data regardless of location.

Question 8

Which compliance standard should a company consider if both controllers and processors have legal entities in the EU?

Accepted Answer

B

Explanation: The General Data Protection Regulation (GDPR) is the primary data protection and privacy law for the European Union (EU). The question specifically mentions "controllers" and "processors," which are legal roles explicitly defined in Article 4 of the GDPR. Furthermore, Article 3 of the GDPR establishes its territorial scope, which applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. Given that the company has legal entities in the EU, it falls directly under the jurisdiction of GDPR.

Question 9

You are attempting to allow access to an application using NP

Accepted Answer

B, C

Explanation: To grant access to a new application via Netspoke Private Access, two fundamental steps are required after initial steering is enabled. First, the application itself must be defined within the Netspoke platform; this is accomplished by creating a "Private App" (C), specifying its domains, IP addresses, and ports. Second, an access control rule must be established to permit traffic. This is done by creating a Real-time Protection "Allow" policy (B) that explicitly grants specific users or groups access to the newly defined application. These two actions form the core workflow for onboarding a new private application.

Question 10

Which three security controls are offered by the Netskope Cloud platform? (Choose three.)

Accepted Answer

B, C, E

Explanation: The Netskope Security Cloud platform provides a unified set of security controls as part of its Security Service Edge (SSE) architecture. These controls include: Data Loss Prevention (DLP): Netskope's advanced DLP inspects data in motion and at rest across thousands of cloud services and websites, including traffic over protocols like SMTP for cloud-based email. Cloud Security Posture Management (CSPM): This is a core capability that continuously assesses IaaS and PaaS environments (e.g., AWS, Azure, GCP) for misconfigurations, compliance violations, and security risks. Threat Protection: Netskope offers multi-layered advanced threat protection to identify and block malware, ransomware, and other threats in real-time using techniques like sandboxing, machine learning, and threat intelligence.

Question 11

Click the Exhibit button.
A user has the Netskope Client enabled with the correct steering configuration applied. The exhibit
shows an inline policy that has a predefined webmail category blocked. However the user is still able
to access Yahoo mail.
Which statement is correct in this scenario?

Accepted Answer

C

Explanation: The most direct cause for an inline policy failing to block traffic, when steering is confirmed to be working, is a mismatch in the policy criteria. The policy is configured to block the "Webmail" category. The user's ability to access Yahoo Mail indicates that, for this specific transaction, the traffic was not classified as belonging to the "Webmail" category by the Netskope security cloud. Therefore, the policy condition was not met, and the "Block" action was not triggered. This can sometimes be influenced by the specifics of the traffic steering method, such as an explicit proxy.

Question 12

You are working with a large retail chain and have concerns about their customer dat
a. You want to protect customer credit card data so that it is never exposed in transit or at rest. In this
scenario, which regulatory compliance standard should be used to govern this data?

Accepted Answer

B

Explanation: The Payment Card Industry Data Security Standard (PCI-DSS) is the specific and mandatory global standard for all entities that store, process, or transmit cardholder data. Its explicit purpose is to protect this sensitive information to reduce credit card fraud. The standard provides a comprehensive framework of 12 requirements, including controls for protecting stored cardholder data (at rest) and encrypting its transmission across open, public networks (in transit). For a retail chain handling customer credit card data, adherence to PCI-DSS is a contractual obligation enforced by the major payment card brands (e.g., Visa, MasterCard).

Question 13

Your organization has implemented Netskope Private Access (NPA) for all users. Users from the
European region are reporting that they are unable to access many of their applications. You suspect
that the publishers for the European data center may be disconnected and you want to verify the
Publishers' status.
Which two methods describe how you would accomplish this task? (Choose two.)

Accepted Answer

A, C

Explanation: The most direct method to verify the real-time connection status of Netskope Private Access (NPA) Publishers is by navigating to the Publishers page within the Netskope UI. This page provides a dedicated dashboard view that explicitly lists each Publisher and its current state (e.g., Connected, Disconnected). Additionally, the Netskope Private Access Troubleshooter is a diagnostic tool designed to validate the end-to-end connectivity for a specific user and application. Running this tool will test the entire service chain, which includes verifying the reachability and connection status of the relevant Publisher, making it an effective method for diagnosing this specific issue.

Question 14

Click the Exhibit button. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Netspoke_NSK101/page_62_img_1.jpg What are two use cases where the parameter shown in the exhibit is required? (Choose two.)

Accepted Answer

A, C

Explanation: The "Instance ID" parameter is used to uniquely identify and differentiate between multiple instances of the same cloud application. This is essential for creating granular policies that distinguish between a sanctioned corporate instance and any unsanctioned or personal instances. Use cases A and C both require this level of specificity. Policy A needs to identify both the sanctioned and personal Google Drive instances to control data flow between them. Policy C needs to identify the specific sanctioned OneDrive instance to apply a targeted data loss prevention (DLP) rule, ensuring it does not affect personal accounts.

Question 15

You want to determine which NewEdge data planes that your remote users have been recently using. Which area of the Netskope Tenant UI would provide this information?

Accepted Answer

A

Explanation: The Digital Experience Management (DEM) feature within the Netskope Tenant UI is specifically designed to monitor the end-user experience. The Client Steering section within DEM provides detailed visibility into how Netskope Clients on remote user devices are connecting to the NewEdge network. This includes information about which specific data plane (POP) a user has recently connected to, along with performance metrics like latency and connection quality. This area is the designated location for troubleshooting and analyzing remote user connectivity patterns to the Netskope cloud infrastructure.

Free Netskope NSK101 Actual Exam Questions