Netskope Certified Cloud Security Architect v1.0
Question 1
You are asked to create a customized restricted administrator role in your Netskope tenant for a newly hired employee.
Which two statements are correct in this scenario? (Choose two.)
- A. An admin role prevents admins from downloading and viewing file content by default.
- B. The scope of the data shown in the UI can be restricted to specific events.
- C. All role privileges default to Read Only for all functional areas.
- D. Obfuscation can be applied to all functional areas.
Answer : BC
Question 2
You are troubleshooting an issue with users who are unable to reach a financial SaaS application when their traffic passes through Netskope. You determine that this is because of IP restrictions in place with the SaaS vendor. You are unable to add Netskope's IP ranges at this time, but need to allow the traffic.
How would you allow this traffic?
- A. Use NPA to implement Source IP anchoring so the traffic will egress from the corporate data center.
- B. Use Explicit Proxy Over Tunnel (EPoT) so the traffic will egress from the corporate data center.
- C. Use Cloud Explicit Proxy so the traffic will egress from the corporate data center.
- D. Use an IPsec tunnel to forward traffic so it will egress from the corporate data center.
Answer : A
Question 3
Review the exhibit.
You are the proxy administrator for a medical devices company. You recently changed a pilot group of users from cloud app steering to all Web traffic. Pilot group users have started to report that they receive the error shown in the exhibit when attempting to access the company intranet site that is publicly available. During troubleshooting, you realize that this site uses your company’s internal certificate authority for SSL certificates.
Which three statements describe ways to solve this issue? (Choose three.)
- A. Import the root certificate for your internal certificate authority into Netskope.
- B. Bypass SSL inspection for the affected site(s).
- C. Create a Real-time Protection policy to allow access.
- D. Change the SSL Error Settings from Block to Bypass in the Netskope tenant.
- E. Instruct the user to proceed past the error message.
Answer : ABD
Question 4
Given the following:
Which result does this Skope IT query provide?
- A. The query returns all events of [email protected] downloading or uploading to or from the site "Amazon S3" using the Netskope Client.
- B. The query returns all events of an IP address downloading or uploading to or from Amazon S3 using the Netskope Client.
- C. The query returns all events of everyone except [email protected] downloading or uploading to or from the site "Amazon S3" using the Netskope Client.
- D. The query returns all events of [email protected] downloading or uploading to or from the application "Amazon S3" using the Netskope Client.
Answer : A
Question 5
A recent report states that users are using non-sanctioned Cloud Storage platforms to share data. Your CISO asks you for a list of aggregated users, applications, and instance IDs to increase security posture.
Which Netskope tool would be used to obtain this data?
- A. Advanced Analytics
- B. Behavior Analytics
- C. Applications in Skope IT
- D. Cloud Confidence Index (CCI)
Answer : A
Question 6
You deployed the Netskope Client for Web steering in a large enterprise with dynamic steering. The steering configuration includes a bypass rule for an application that is IP restricted.
What is the source IP for traffic to this application when the user is on-premises at the enterprise?
- A. Loopback IPv4
- B. Netskope data plane gateway IPv4
- C. Enterprise Egress IPv4
- D. DHCP assigned RFC1918 IPv4
Answer : C
Question 7
Your company has a large number of medical forms that are allowed to exit the company when they are blank. If the forms contain sensitive data, the forms must not leave any company data centers, managed devices, or approved cloud environments. You want to create DLP rules for these forms.
Which first step should you take to protect these forms?
- A. Use Netskope Secure Forwarder to create EDM hashes of all forms.
- B. Use Netskope Secure Forwarder to create an MIP tag for all forms.
- C. Use Netskope Secure Forwarder to create fingerprints of all forms.
- D. Use Netskope Secure Forwarder to create an ML Model of all forms.
Answer : C
Question 8
You are consuming Audit Reports as part of a Salesforce API integration. Someone has made a change to a Salesforce account record field that should not have been made and you are asked to verify the previous value of the structured data field. You have the approximate date and time of the change, user information, and the new field value.
How would you accomplish this task?
- A. Create a classic report and apply a query that filters on the changed field value.
- B. Use the Application Events Data Collection within Advanced Analytics and filter on the changed field value.
- C. Query Skope IT Page Events and look for the specific Page URL that was called under the Application section.
- D. Query Skope IT for an Access Method of API Connector and search Application Event Details for the Old Value field using the User details and Edit Activity.
Answer : D
Question 9
You configured a pair of IPsec tunnels from the enterprise edge firewall to a Netskope data plane. These tunnels have been implemented to steer traffic for a set of defined HTTPS SaaS applications accessed from end-user devices that do not support the Netskope Client installation. You discover that all applications steered through this tunnel are non-functional.
According to Netskope, how would you solve this problem?
- A. Restart the tunnel to stop the tunnel from flapping.
- B. Downgrade from IKE v2 to IKE v1.
- C. Install the Netskope root and intermediate certificates on the end-user devices.
- D. Disable Perfect Forward Secrecy on the tunnel configuration.
Answer : C
Question 10
Your company just had a new Netskope tenant provisioned and you are asked to create a secure tenant configuration.
In this scenario, which two default settings should you change? (Choose two.)
- A. Change Safe Search to Disabled.
- B. Change Untrusted Root Certificate to Block.
- C. Change the No SNI setting to Block.
- D. Change "Disallow concurrent logins by an Admin" to Enabled.
Answer : BC
Question 11
You successfully configured Advanced Analytics to identify policy violation trends. Upon further investigation, you notice that the activity is NULL.
Why is this happening in this scenario?
- A. The SSPM policy was not configured during setup.
- B. The REST API v1 token has expired.
- C. A policy violation was identified using API Protection.
- D. A user accessed a static Web page.
Answer : D
Question 12
You want customers to configure Real-time Protection policies.
In which order should the policies be placed in this scenario?
- A. Threat, CASB, RBI, Web
- B. RBI, CASB, Web, Threat
- C. Threat, RBI, CASB, Web
- D. CASB, RBI, Threat, Web
Answer : C
Question 13
You are currently designing a policy for AWS S3 bucket scans with a custom DLP profile.
Which policy action(s) are available for this policy?
- A. Alert, Quarantine, Block, User Notification
- B. Alert, User Notification
- C. Alert only
- D. Alert, Quarantine
Answer : C
Question 14
You are architecting a Netskope steering configuration for devices that are not owned by the organization. The users could be either on-premises or off-premises and the architecture requires that traffic destined to the company’s instance of Microsoft 365 be steered to Netskope for inspection.
How would you achieve this scenario from a steering perspective?
- A. Use IPsec and GRE tunnels.
- B. Use reverse proxy.
- C. Use explicit proxy and the Netskope Client.
- D. Use DPoP and Secure Forwarder.
Answer : C
Question 15
You are implementing a solution to deploy Netskope for machine traffic in an AWS account across multiple VPCs. You want to deploy the least amount of tunnels while providing connectivity for all VPCs.
How would you accomplish this task?
- A. Use IPsec tunnels from the AWS Virtual Private Gateway.
- B. Use GRE tunnels from the AWS Transit Gateway.
- C. Use GRE tunnels from the AWS Virtual Private Gateway.
- D. Use IPsec tunnels from the AWS Transit Gateway.
Answer : D