NSK300 Questions and Answers

To ensure that no data is uploaded to non-AcmeCorp instances of OneDrive, the policies that would accomplish this are:

Policy B: This policy allows traffic only for AcmeCorp’s OneDrive and blocks all other Microsoft 365 Suite traffic. It ensures that data is not uploaded to non-AcmeCorp OneDrive instances by restricting access to only the corporate instance of OneDrive.

Policy C: This policy allows traffic for AcmeCorp’s Microsoft 365 Suite but blocks all other OneDrive for Business traffic. It achieves the same outcome by permitting corporate suite usage while preventing uploads to any OneDrive for Business instances that are not part of AcmeCorp.

These policies are designed to provide granular control over the data flow, ensuring that company data remains within the corporate environment and is not transferred to external or personal storage solutions.

To prevent potential routing issues and ensure that the Netskope agent consistently sees the traffic first, it is recommended to modify the VPN to operate in full tunnel mode at Layer 3.

In full tunnel mode, all traffic from the endpoint is routed through the VPN, including traffic destined for Netskope. This ensures that the Netskope agent can inspect and apply policies to all traffic, regardless of the destination.

Layer 3 full tunnel mode provides better visibility and control over the traffic flow, reducing the risk of routing conflicts or bypassing the Netskope inspection. References:

The answer is based on general knowledge of VPN configurations and their impact on traffic routing.

Users from Companies A, B, and C can indeed be provisioned to Netskope. Company A, which uses Active Directory, can continue to use the existing AD Importer. For Company B that uses Azure AD and Company C that uses Okta Universal Directory, integration with SCIM (System for Cross-domain Identity Management) solutions is possible. Netskope supports provisioning users from multiple directories, including Active Directory and cloud-based identity providers like Azure AD and Okta, by using additional AD Importers and integrating more than one SCIM solution12.

When a user is on-premises at the enterprise and accesses an application that is IP restricted, the source IP for traffic to this application is the Enterprise Egress IPv4 address.

The Enterprise Egress IP represents the external IP address of the enterprise network as seen by external services or applications.

This IP address is used for communication between the user’s device and external resources, including applications that are IP restricted. References:

The answer is based on general knowledge of networking concepts and how IP addresses are used in enterprise environments.

The given Skope IT query specifies the following conditions:

User equals ‘user@company.com’

Access method equals ‘Client’

Activity equals ‘Download’ or ‘Upload’

Site equals ‘Amazon S3’

The query combines these conditions using logical operators (AND and OR).

The result of this query will include all events where the specified user (‘user@company.com’) is either downloading or uploading data to or from the site ‘Amazon S3’ using the Netskope Client.

It does not include events related to other users or IP addresses. References:

Netskope Security Cloud Introductory Online Technical Training

Netskope Security Cloud Operation & Administration (NSCO&A) - Classroom Training

The issue is likely caused by a missing group name in the SAML response (A). When access to Microsoft 365 from unmanaged devices is not blocked as expected, despite having a policy in place, it often indicates that the SAML assertion is not correctly identifying the user as a member of the restricted group. In this case, the “marketing-users” group name should be present in the SAML response to enforce the policy that blocks login activity for this group. If the group name is missing, the policy will not apply, and users will not be blocked as intended.

The reason for the activity being NULL in this scenario is likely because a user accessed a static Web page. In Netskope’s Advanced Analytics, when the activity is reported as NULL, it often indicates that there was no dynamic interaction or transaction to record, which is typical when a static web page is accessed1. Static web pages do not generate the kind of events or activities that are tracked by policies, hence they appear as NULL in the activity field.

When configuring a Real-time Protection policy with multiple DLP profiles, if the content matches multiple profiles, the policy performs the most restrictive action associated with the DLP profiles that match for that policy. The resulting incident lists all the profiles that matched along with their corresponding forensic information. This means that even though the most restrictive action is taken, details for all matching profiles are created and included in a single DLP incident12.

To integrate Netskope with a third-party DLP engine using ICAP, you must configure the Netskope Secure Forwarder.

Secure Forwarder is the only Netskope component that supports:

ICAP communication

Forwarding inline web traffic to external DLP engines

Bidirectional ICAP requests/responses (REQMOD/RESPMOD)

This allows Netskope to send inspected content to your on-prem or third-party DLP appliance for additional scanning.

Why the other options are incorrect

A. On-Premises Log Parser (OPLP)Used for ingesting logs into Netskope — not for ICAP or traffic processing.

C. Netskope Cloud ExchangeUsed for integrations with SIEM, SOAR, ticketing, threat intel — not for inline DLP.

D. Netskope AdapterUsed mainly for SSPM/API integrations — not relevant for ICAP or external DLP engines.