[2024年03月] を試そう！リアルNSK100問題集で100%無料NSK100試験問題集 [Q16-Q34]

4.5/5 - (2 votes)

[2024年03月] を試そう！リアルNSK100問題集で100%無料NSK100試験問題集

NSK100のPDF問題集試験問題有効なNSK100問題集

Netskope NSK100 認定試験の出題範囲：

トピック	出題範囲
トピック 1	Identifying cloud risk using the Cloud Confidence Index (CCI) Common industry compliance standards
トピック 2	Web security concepts Basic administration tasks
トピック 3	Netskope Platform Monitoring Steering traffic to Netskope
トピック 4	Real-time inline or API policy configuration concepts Data-in-motion protection compared to data-at-rest concepts
トピック 5	Common cloud service model concepts Collect log files used for service requests
トピック 6	Netskope Platform Management Cloud security risk management reduction
トピック 7	Netskope Platform Concepts Basics Netskope Platform Troubleshooting
トピック 8	Cloud Security Concepts TLS decryption-related issues
トピック 9	Policy-related misconfigurations Features and architectural benefits

新問題 16
Which two statements describe a website categorized as a domain generated algorithm (DGA)? (Choose two.)

The website is used for domain registration.

The domain contains malicious algorithms.

The website is used to hide a command-and-control server.

The domain was created by a program.

新問題 17
You are required to mitigate malicious scripts from being downloaded into your corporate devices every time a user goes to a website. Users need to access websites from a variety of categories, including new websites.
Which two actions would help you accomplish this task while allowing the user to work? (Choose two.)

Allow the user to browse uncategorized domains but restrict edit activities.

Block malware detected on download activity for all remaining categories.

Block known bad websites and enable RBI to uncategorized domains.

Allow a limited amount of domains and block everything else.

新問題 18
You want to deploy Netskope’s zero trust network access (ZTNA) solution, NPA. In this scenario, which action would you perform to accomplish this task?

Create an OAuth identity access control between your users and your applications.

Set up a reverse proxy using SAML and an identity provider.

Enable Steer all Private Apps in your existing steering configuration(s) from the admin console.

Configure SCIM to exchange identity information and attributes with your applications.

新問題 19
You just deployed the Netskope client in Web mode and several users mention that their messenger application is no longer working. Although you have a specific real-time policy that allows this application, upon further investigation you discover that it is using proprietary encryption. You need to permit access to all the users and maintain some visibility.
In this scenario, which configuration change would accomplish this task?

Change the real-time policy to block the messenger application.

Create a new custom cloud application using the custom connector that can be used in the real-time policy.

Add a policy in the SSL decryption section to bypass the messenger domain(s).

Edit the steering configuration and add a steering exception for the messenger application.

新問題 20
A customer asks you to create several real-time policies. Policy A generates alerts when any user downloads, uploads, or shares files on a cloud storage application. Policy B blocks users from downloading files from any operating system (OS) other than Mac or Windows for cloud storage. In this case, policy A is least restrictive and policy B is more restrictive.
Which statement is correct in this scenario?

Policy A is implemented before policy B.

Policy B is implemented before policy A.

The policy order is not important; policies are independent of each other.

These two policies would actually not work together.

新問題 21
You want to prevent Man-in-the-Middle (MITM) attacks on an encrypted website or application. In this scenario, which method would you use?

Use a stronger encryption algorithm.

Use certificate pinning.

Use a proxy for the connection.

Use a weaker encryption algorithm.

新問題 22
In which scenario would you use a SAML reverse proxy?

When the API-enabled protection exceeds the Cloud App API usage limits and cannot be used anymore.

When the organization wants to perform inline inspection of cloud application traffic for roaming users that do not have the Netskope agent installed.

When there are multiple SAML IdPs in use and the SAML reverse proxy can help federate them all together.

When PAC files or explicit proxies can be used to steer traffic to the Netskope platform.

新問題 23
What is the limitation of using a legacy proxy compared to Netskope’s solution?

Netskope architecture requires on-premises components.

Legacy solutions offer higher performance and scalability for corporate and remote users.

Legacy on-premises solutions fail to provide protection for traffic from on-premises users.

To enforce policies, traffic needs to traverse back through a customer’s on-premises security stack.

新問題 24
Which three statements are correct about Netskope’s NewEdge Security Cloud Network Infrastructure?
(Choose three.)

It takes advantage of the public cloud by deploying security services on Google Cloud Platform.

It includes direct peering with Microsoft and Google in every data center.

It is a private security cloud network that is massively over provisioned, highly elastic, and built for scale.

It delivers a single, unified network with no surcharges or reliance on public cloud infrastructure or virtual PoPs.

It simplifies the administrator’s job by limiting access to pre-defined availability zones.

新問題 25
There is a DLP violation on a file in your sanctioned Google Drive instance. The file is in a deleted state. You need to locate information pertaining to this DLP violation using Netskope. In this scenario, which statement is correct?

You can find DLP violations under Forensic profiles.

DLP incidents for a file are not visible when the file is deleted.

You can find DLP violations under the Incidents dashboard.

You must create a forensic profile so that an incident is created.

新問題 26
What is a benefit that Netskope instance awareness provides?

It prevents movement of corporate sensitive data to a personal Dropbox account.

It prevents the user from copying information from a corporate email and pasting the information into a GitHub repository.

It differentiates between an IT managed Google Drive instance versus a personal Dropbox account.

It differentiates between an IT managed Google Drive instance versus a personal Google Drive instance.

新問題 27
Which three technologies describe the primary cloud service models as defined by the National Institute of Standards and Technology (NIST)? (Choose three.)

Cloud Service Provider (CSP)

Identity as a Service (IDaaS)

Platform as a Service (PaaS)

Software as a Service (SaaS)

Infrastructure as a Service (laaS)

Explanation
The three technologies that describe the primary cloud service models as defined by the National Institute of Standards and Technology (NIST) are Platform as a Service (PaaS), Software as a Service (SaaS), and Infrastructure as a Service (IaaS). These service models are based on the type of computing capability that is provided by the cloud provider to the cloud consumer over a network. According to NIST, these service models have the following definitions:
Platform as a Service (PaaS): The capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages, libraries, services, and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment.
Software as a Service (SaaS): The capability provided to the consumer is to use the provider’s applications running on a cloud infrastructure. The applications are accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based email), or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.
Infrastructure as a Service (IaaS): The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications; and possibly limited control of select networking components (e.g., host firewalls).
References: The NIST Definition of Cloud ComputingNIST Cloud Computing Program

新問題 28
Why would you want to define an App Instance?

to create an API Data Protection Policy for a personal Box instance

to differentiate between an enterprise Google Drive instance vs. a personal Google Drive instance

to enable the instance_id attribute in the advanced search field when using query mode

to differentiate between an enterprise Google Drive instance vs. an enterprise Box instance

新問題 29
You have applied a DLP Profile to block all Personally Identifiable Information data uploads to Microsoft 365 OneDrive. DLP Alerts are not displayed and no OneDrive-related activities are displayed in the Skope IT App Events table.
In this scenario, what are two possible reasons for this issue? (Choose two.)

The Cloud Storage category is in the Steering Configuration as an exception.

The destination domain is excluded from decryption in the decryption policy.

A Netskope POP is not in your local country and therefore DLP policies cannot be applied.

DLP policies do not apply when using IPsec as a steering option.

新問題 30
What are two primary advantages of Netskope’s Secure Access Service Edge (SASE) architecture? (Choose two.

no on-premises hardware required for policy enforcement

Bayesian spam filtering

Endpoint Detection and Response (EDR)

single management console

新問題 31
What are two reasons why legacy solutions, such as on-premises firewalls and proxies, fail to secure the data and data access compared to Netskope Secure Web Gateway? (Choose two.)

Legacy solutions are unable to see the user who is trying to access the application.

The applications where the data resides are no longer in one central location.

Legacy solutions do not meet compliance standards.

The users accessing this data are not in one central place.

新問題 32
You want to take into account some recent adjustments to CCI scoring that were made in your Netskope tenant.
In this scenario, which two CCI aspects in the Ul would be used in a real-time protection policy? (Choose two.)

App Tag

CCL

App Score

GDPR Readiness

新問題 33
You need to provide a quick view under the Skope IT Applications page showing only risky shadow IT cloud applications being used.
In this scenario, which two filter combinations would you use to accomplish this task? (Choose two.)

Sanctioned = No

CCL = High. Under Research

User Device Type = Windows Device

CCL = Medium. Low, Poor

新問題 34
What are two use cases for Netskope’s DLP solution? (Choose two.)

to stop unintentional data movement

to detect malware in files before they are uploaded to a cloud application

to detect sensitive data in password protected files

to ensure regulatory compliance