Question 1

Your company has many users that are remote and travel often. You want to provide the greatest
visibility into their activities, even while traveling. Using Netskope. which deployment method would
be used in this scenario?

Accepted Answer

B

Explanation: The Netskope Client is a software agent installed on endpoint devices (laptops, mobile phones) that steers traffic to the Netskope Security Cloud. This method is specifically designed for roaming and remote users, as it provides consistent visibility and policy enforcement regardless of the user's physical location or network connection. By capturing traffic directly from the endpoint, it ensures the greatest visibility into user activities, whether they are in the office, at home, or traveling, which directly addresses the scenario's requirements.

Question 2

While most Web and SaaS traffic is decrypted for inspection, you are asked to prevent a certain host on the network from SSL decryption for privacy purposes.

Accepted Answer

C

Explanation: The most precise and appropriate method to prevent SSL decryption for a specific host is to create an SSL Decryption policy. This involves defining the host's IP address as a "Source Network Location" and then creating a policy rule with the action "Do Not Decrypt" that applies specifically to that location. This approach ensures that traffic from the host is still steered to the Netskope security cloud for other policy enforcement (like URL filtering), but the TLS session is not intercepted for deep inspection, thus meeting the privacy requirement without completely bypassing all security controls.

Question 3

You are currently migrating users away from a legacy proxy to the Netskope client in the company’s
corporate offices. You have deployed the client to a pilot group; however, when the client attempts
to connect to Netskope, it fails to establish a tunnel.
In this scenario, what would cause this problem?

Accepted Answer

B

Explanation: The Netskope Client first attempts to form a secure DTLS tunnel to the nearest NewEdge/EPoP over UDP 443. If the corporate firewall filters or blocks outbound UDP 443 (and the matching return traffic), the DTLS handshake never completes and the client remains in the “Connecting” state, so no tunnel is established. Other factors (SSL interception, DNS resolution, EPoP FQDN reachability) do not prevent the client from at least negotiating a fallback TCP/443 control channel; only loss of UDP 443 definitively stops tunnel creation in an on-premise pilot deployment.

Question 4

After deploying the Netskope client to a number of devices, users report that the Client status
indicates "Admin Disabled". User and gateway information is displayed correctly in the client
configuration dialog
Why are clients installing in an "Admin Disabled" state in this scenario?

Accepted Answer

A

Explanation: The "Admin Disabled" status is a specific state reported by the Netskope Client. It indicates that a Netskope administrator has explicitly disabled the device from the Netskope tenant's web interface (under Settings > Security Cloud Platform > Devices). This action is typically taken to troubleshoot an issue or temporarily remove a device from service without uninstalling the client. The fact that user and gateway information is displayed correctly confirms that the client successfully enrolled and is communicating with the tenant, but its traffic steering functionality has been administratively deactivated.

Question 5

You discover the ongoing use of the native Dropbox client in your organization. Although Dropbox is
not a corporate-approved application, you do not want to prevent the use of Dropbox. You do,
however, want to ensure visibility into its usage.

Accepted Answer

D

Explanation: The goal is to gain visibility into the native Dropbox client's traffic without blocking it. The most effective way to achieve this within the Netskope platform is to ensure the traffic is steered to the Netskope Security Cloud for inspection. A steering exception of the type "Destination Locations" allows an administrator to specifically target traffic destined for the Dropbox application. By creating this exception and ensuring the action is set to steer (e.g., "Tunnel"), the Netskope Client on user devices will be instructed to send all traffic from the native Dropbox client through the Netskope cloud. This provides the required visibility for policy enforcement and monitoring.

Question 6

Your company has a Symantec BlueCoat proxy on-premises and you want to deploy Netskope using proxy chaining. Which two prerequisites need to be enabled first in this scenario? (Choose two.)

Accepted Answer

C, D

Explanation: In a proxy chaining deployment, the on-premises proxy (Symantec BlueCoat) forwards traffic to the Netskope cloud proxy. For this architecture to be effective, Netskope must have visibility into the original traffic source and its content. First, the on-premises proxy must be configured to insert the original client's IP address into the X-Forwarded-For (XFF) HTTP header. Without this, Netskope would only see the IP address of the on-premises proxy, preventing accurate logging and the application of source IP-based policies. Second, to inspect encrypted HTTPS traffic for threats, data loss (DLP), and granular application control, SSL decryption must be enabled within the Netskope platform. This is a fundamental requirement for a Security Service Edge (SSE) solution to be effective.

Question 7

You are using Skope IT to analyze and correlate a security incident. You are seeing too many events generated by API policies. You want to filter for logs generated by the Netskope client only.

Accepted Answer

A

Explanation: In Netskope's Skope IT, the accessmethod filter is used to differentiate the source of traffic and events. To isolate events originating specifically from endpoints with the Netskope agent installed, the correct filter value is Client. This action effectively filters out events from other sources, such as API-based policies (API Connector), network tunnels (IPsec, GRE), or other forwarding methods. Selecting Client directly achieves the user's goal of viewing only logs generated by the Netskope client.

Question 8

Review the exhibit. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Netskope_NSK200/page_11_img_1.jpg You are troubleshooting a Netskope client for user Clarke which remains in a disabled state after being installed. After looking at various logs, you notice something which might explain the problem. The exhibit is an excerpt from the nsADImporterLog.log. Referring to the exhibit, what is the problem?

Accepted Answer

B

Explanation: The provided log excerpt is from nsADImporterLog.log, which is generated by the Netskope Directory Importer tool used for synchronizing Active Directory (AD) users with the Netskope tenant. The log entry "action":"delete" for the user "Clarke Kent" is definitive evidence that the user's account has been removed from the Netskope tenant via this synchronization process. The Netskope Client requires an active, provisioned user account in the tenant to successfully enroll and enable. Because the user has been deleted from the tenant, the client cannot associate with a valid user profile and therefore remains in a disabled state.

Question 9

You want to prevent a document stored in Google Drive from being shared externally with a public link.

Accepted Answer

C

Explanation: An API Data Protection policy is the correct mechanism for this use case. This type of policy uses API introspection to connect directly to the cloud application (Google Drive) to scan data at rest. It can be configured to detect files based on their exposure, such as being shared "publicly" or "externally." Upon detection, the policy can trigger an automated remediation action, like revoking the public sharing link, thereby preventing the unintended exposure of the document. This method is effective for both newly shared files and for retroactively securing files that were previously shared improperly.

Question 10

Your company wants to know if there has been any unusual user activity. In the UI, you go to Skope IT -> Alerts. Which two types of alerts would you filter to find this information? (Choose two.)

Accepted Answer

A, B

Explanation: To identify unusual user activity, an administrator should filter for alerts generated by Netskope's User and Entity Behavior Analytics (UEBA) engine. The UEBA engine establishes a baseline of normal behavior for each user and then flags deviations. In the Skope IT > Alerts interface, these deviations are categorized under two primary alert types: anomaly and uba. The anomaly type specifically flags activities that deviate from a user's established behavioral baseline, while uba is the broader category for alerts generated by the behavior analytics engine. Filtering by these two types directly surfaces potential insider threats, compromised accounts, or other unusual user actions.

Question 11

Your IT organization is migrating its user directory services from Microsoft Active Directory to a cloud-
based Identity Provider (IdP) solution, Azure AD. You are asked to adapt the Netskope user
provisioning process to work with this new cloud-based IdP.

Accepted Answer

C

Explanation: SCIM (System for Cross-domain Identity Management) is the industry-standard protocol for automating user provisioning between cloud services. When migrating to a cloud-based Identity Provider (IdP) like Azure AD, SCIM is the appropriate and recommended method to provision and synchronize users and groups into the Netskope platform. This allows for automated, real-time updates to user identities and group memberships directly from Azure AD, ensuring that Netskope policies are applied based on the most current directory information. This approach replaces the need for on-premises tools like the Directory Importer, which is designed for Active Directory.

Question 12

A customer wants to use Netskope to prevent PCI data from leaving the corporate sanctioned
OneDrive instance. In this scenario. which two solutions would assist in preventing data exfiltration?
(Choose two.)

Accepted Answer

A, D

Explanation: To prevent PCI data exfiltration from a sanctioned OneDrive instance, a comprehensive approach covering data-at-rest and data-in-motion is required. Netskope's API Data Protection connects directly to the OneDrive API to scan all existing data (data-at-rest). It can identify files containing PCI data and apply remediation actions, such as revoking public sharing links or quarantining files, to prevent exposure. Simultaneously, Real-time Protection provides inline inspection for data-in-motion. As users upload, download, or share files, Netskope inspects the traffic and content in real-time, blocking any transaction that violates the PCI data policy before the exfiltration is complete. Together, these solutions provide robust protection.

Question 13

You want to allow both the user identities and groups to be imported in the Netskope platform. Which two methods would satisfy this requirement? (Choose two.)

Accepted Answer

A, C

Explanation: Netskope provides several methods for user and group provisioning. System for Cross-domain Identity Management (SCIM) is an open standard that automates user provisioning from Identity Providers (IdPs) like Azure AD or Okta, and it explicitly supports the synchronization of both users and groups. The Netskope Directory Importer is a dedicated, lightweight tool designed to connect to on-premises Active Directory or LDAP servers to read and upload user and group information directly into the Netskope platform. Both methods are designed to import and maintain user and group structures from an authoritative source.

Question 14

Your customer is concerned about malware in their AWS S3 buckets. What two actions would help with this scenario? (Choose two.)

Accepted Answer

B, C

Explanation: To address malware within AWS S3 buckets, Netskope utilizes its API-enabled protection capabilities. The first necessary action is to enable the Threat Protection (Malware Scan) feature for the specific AWS instance configured within the Netskope tenant. This activates the scanning engine. The second action is to create an API Data Protection policy. This policy defines the scope (which S3 buckets to scan) and the response action, such as quarantining any files identified as malware by the scan. Together, these two steps provide a complete solution for detecting and remediating threats at-rest in cloud storage.

Question 15

You notice that your Netskope client icon has a red dot and see "Disabled due to error" when hovering the mouse over the icon. What are two reasons for this message? (Choose two.)

Accepted Answer

A, C

Explanation: The "Disabled due to error" status on the Netskope Client icon indicates a critical failure that prevents the client from steering traffic. This state is triggered by two primary conditions. First, if the core client service (e.g., stunnel.exe or nsservice.exe) is manually stopped or has crashed, the client cannot function and will report this error. Second, if the client's internal health checks fail—for instance, if it cannot resolve or connect to its assigned Netskope gateway—it will enter a disabled state to prevent network disruption. Both scenarios represent a fundamental inability of the client to perform its duties, thus triggering the error state.

Free Netskope NSK200 Actual Exam Questions