Netskope Certified Cloud Security Administrator Exam NSK101 NCCSA Exam Questions

Answer : A, B

Create the Report in Advanced Analytics:

Data Collection:

Use the 'Page Events' data collection, which captures detailed user activities on web pages, including edits and uploads.

Filters:

Apply filters to include only the activities 'Edit' and 'Upload'.

Add another filter for the Cloud Confidence Level (CCL) to include only those with 'Low' or 'Poor' ratings.

This ensures the report focuses on the specified user activities within cloud applications that have lower security ratings.

Steps:

Navigate to Advanced Analytics > Reports.

Create a new report and select 'Page Events' as the data collection source.

Apply the necessary filters for activities and CCL values.

Schedule the Report:

Monthly Recurrence:

Set the report to run on a monthly schedule to ensure regular updates.

Configure the report to be sent via email with a PDF attachment.

Steps:

In the report scheduling options, set the recurrence to monthly.

Specify the email recipients, ensuring the CISO receives the report.

Select PDF as the report format.

Reference:

For more details on creating and scheduling reports, refer to the Netskope documentation on Advanced Analytics and report generation.

Answer : C

To discover GDPR data publicly exposed in Microsoft 365, Salesforce, and Slack-sanctioned cloud applications, you need to use a deployment model that allows Netskope to access and scan the data stored in these applications using out-of-band API connections. The deployment model that would match this requirement is API-enabled protection, which is a feature in the Netskope platform that allows you to connect your sanctioned cloud applications to Netskope using API connectors. This enables you to discover sensitive data, enforce near real-time policy controls, and quarantine malware in your cloud applications without affecting user experience or performance. You can use Netskope's data loss prevention (DLP) engine to scan for GDPR data in your cloud applications and identify any public exposure or sharing settings that may violate the regulation. A reverse proxy, an on-premises appliance, or an inline protection are not deployment models that would help you discover GDPR data publicly exposed in your sanctioned cloud applications, as they are more suitable for inline modes that rely on intercepting traffic to and from these applications in real time, rather than accessing data stored in these applications using APIs.Reference:[Netskope SaaS API-enabled Protection], [Netskope Data Loss Prevention].

Answer : B, C

Secure Access Service Edge (SASE) is a cloud-based architecture that combines various cloud security and infrastructure enablement technologies into a unified platform that delivers security and networking services from the edge of the network. Two of these technologies are Zero Trust Network Access (ZTNA) and Cloud Access Security Broker (CASB). ZTNA is a technology that provides secure access to private applications without exposing them to the internet or using VPNs. It uses identity-based policies and encryption to grant granular access to authorized users and devices, regardless of their location or network. CASB is a technology that provides visibility and control over cloud applications (SaaS) used by users and devices. It uses API connections or inline proxies to inspect and enforce policies on data and activities in cloud applications, such as data loss prevention, threat protection, or compliance. Distributed Denial of Service Protection (DDoS) and Unified Threat Management (UTM) are not technologies that SASE combines into its unified platform, although they may be related or integrated with some of its components.Reference:[SASE], [ZTNA], [CASB].

Answer : C

Reverse Proxy Overview:

A reverse proxy allows users to access sanctioned cloud applications securely from public or untrusted networks.

It ensures that the traffic is inspected and policy controls are enforced before reaching the cloud application.

Scenario Justification:

Users connecting from public computers, such as those in hotel business centers, cannot have a steering client installed, and IPsec/GRE tunnels are not feasible.

Proxy chaining requires control over the client's browser settings, which is not possible in this scenario.

A reverse proxy can handle the traffic without requiring configuration changes on the public computer.

Implementation:

Configure the reverse proxy to handle traffic for sanctioned applications.

Ensure the reverse proxy settings are enforced via your organization's security policies.

Reference:

Detailed configurations and use cases can be found in the Netskope documentation on reverse proxy solutions.

Answer : C, D

Two statements that describe a website categorized as a domain generated algorithm (DGA) are: The website is used to hide a command-and-control server and the domain was created by a program. A domain generated algorithm (DGA) is a technique used by cyber attackers to generate new domain names and IP addresses for malware's command and control servers. Executed in a manner that seems random, it makes it nearly impossible for threat hunters to detect and contain the attack. A command-and-control server is a server that communicates with malware installed on infected machines and sends commands or updates to them. A program is a piece of software that performs a specific task or function. A domain generated algorithm is implemented by a program that runs on the attacker's machine or the malware itself, and produces a large number of domain names based on some logic, such as date, time, seed, dictionary, etc.Reference:Domain generation algorithmAmong cyber-attack techniques, what is a DGA?

Answer : B

DLP Incident View:

To see the actual data that caused a policy violation within a DLP incident, detailed logging and data capture are required.

Forensics Profile:

A Forensics Profile in Netskope is designed to capture and store detailed information about policy violations, including the actual data that triggered the incident.

It provides a comprehensive view of the incident for investigation and compliance purposes.

Setup Process:

Navigate to the DLP settings in the Netskope admin console.

Configure a Forensics Profile to capture detailed logs and data for policy violations.

Ensure that this profile is associated with the relevant DLP policies.

Reference:

For detailed configuration steps, refer to the Netskope documentation on setting up Forensics Profiles for DLP incidents.

Answer : C

Identify Non-standard HTTPS Ports:

Determine the specific non-standard HTTPS ports used by the business application.

Create a Steering Exception:

Navigate to the Netskope admin console.

Go to the steering configuration section and create a new steering exception.

Specify the domain of the business application and include the non-standard HTTPS ports.

This exception will ensure that traffic to this application is steered correctly for inspection and control.

Configure Non-standard Ports in the Steering Configuration:

Go to the steering configuration settings.

Add the identified non-standard HTTPS ports to ensure that all traffic using these ports is captured and inspected.

This ensures comprehensive visibility and control over the user activities on the application.

Reference:

For more details on steering configurations and managing exceptions, refer to the Netskope documentation on steering traffic and configuring non-standard ports.