Netskope NSK300 - Netskope Certified Cloud Security Architect Exam

The reported issue of slow website and SaaS application access for users in the San Francisco branch office, despite being connected to a Netskope data plane in New York, can be attributed to the geographical distance between the user location and the data plane. The Netskope Security Cloud operates through a distributed network of data planes strategically placed in various regions. When users connect to a data plane that is geographically distant, it can result in latency due to longer network traversal times. In this case, the closest Netskope data plane to San Francisco might be unavailable or experiencing high load, leading to performance issues. To address this, consider optimizing data plane selection based on proximity to the user location or investigating any data plane availability or performance issues.

For a server subnet that is isolated and requires content filtering for any server that might access the Internet using a browser, the two Netskope deployment methods that would meet this requirement are:

B. Deploy Data Plane on Premises (DPoP) with a proxy configuration on the servers: Deploying DPoP would allow the isolated servers to connect to the Netskope cloud for content filtering through a proxy configuration. This setup would enable the servers to have controlled access to the Internet for content filtering purposes without requiring direct Internet access1.

C. Deploy IPsec or GRE tunnels in the segment to steer traffic from the servers to Netskope: By deploying IPsec or GRE tunnels, the traffic from the servers can be securely directed to Netskope for content filtering. This method is suitable for environments where servers do not have direct Internet access, as the tunnel provides a secure path for traffic to reach Netskope’s cloud services1.

These deployment methods are designed to work in environments with strict network isolation and provide the necessary content filtering capabilities for servers accessing the Internet.

For a new Netskope tenant provisioned, to create a secure tenant configuration, you should consider changing the following default settings:

B. Change Untrusted Root Certificate to Block: This setting will ensure that any traffic coming from an untrusted root certificate is blocked, which is a critical security measure to prevent man-in-the-middle attacks and other types of cyber threats1.

D. Change “Disallow concurrent logins by an Admin” to Enabled: This setting will prevent multiple concurrent logins by the same admin account, which is an important security control to mitigate the risk of unauthorized access. If an admin’s credentials are compromised, this setting will help limit the potential damage by ensuring that only one session can be active at a time1.

These changes are part of the recommended security hardening guidelines for Netskope tenants to enhance the overall security posture of the tenant environment.

The inconsistent results observed during User Acceptance Testing (where marketing users sometimes access gambling sites and sometimes are blocked) are likely due to the configuration of the Forward Proxy.

Cookie Surrogate: The Cookie Surrogate is a mechanism used in Forward Proxy deployments to maintain user context across multiple requests. It ensures that user-specific policies are consistently applied even when multiple users share the same IP address (common in VDI environments).

Issue: If the Forward Proxy is not configured to use the Cookie Surrogate, it may lead to inconsistent behavior. When different users log into the VDI server, their requests may not be associated with their specific user context, resulting in varying policy enforcement.

Solution: Ensure that the Forward Proxy is properly configured to use the Cookie Surrogate, allowing consistent policy enforcement based on individual user identities. References:

Netskope Security Cloud Operation & Administration (NSCO&A) - Classroom Training

Netskope Security Cloud Introductory Online Technical Training

Netskope Architectural Advantage Features

In the scenario where users are unable to access an application through Netskope Private Access, and after verifying that the Real-time Protection policy allows access, the application is steered for the users, and it is reachable from internal machines, the next step is to verify the application’s reachability through the Netskope Publisher. The two tools in the Netskope UI that would be used to accomplish this task are:

A. Reachability Via Publisher in the App Definitions page - This tool allows you to check if the application is reachable through the configured Publishers. It is essential to ensure that the application’s connectivity is intact and that there are no issues with the Publishers themselves.

B. Troubleshooter tool in the App Definitions page - The Troubleshooter tool can help diagnose and resolve issues related to application reachability. It provides insights into potential problems and offers guidance on how to fix them.

These tools are designed to assist in troubleshooting and ensuring that applications are accessible through Netskope Private Access.

A. Import the root certificate for your internal certificate authority into Netskope:

This step ensures that Netskope recognizes and trusts SSL certificates issued by your company’s internal certificate authority. By importing the root certificate, you enable proper SSL inspection and validation for internal sites.

B. Bypass SSL inspection for the affected site(s):

Since the intranet site uses your company’s internal certificate authority, bypassing SSL inspection for this specific site allows users to access it without encountering SSL errors.

D. Change the SSL Error Settings from Block to Bypass in the Netskope tenant:

Adjusting the SSL Error Settings to “Bypass” allows users to proceed past SSL errors, including self-signed certificate errors. This ensures uninterrupted access to the intranet site. References:

Netskope Security Cloud Introductory Online Technical Training

Netskope Security Cloud Operation & Administration (NSCO&A) - Classroom Training

Netskope Cloud Security Certification Program

In the scenario where CASB traffic steering is enabled using the Netskope Client without a Real-time Protection policy being activated, the default behavior of the traffic is to allow and log it (B). This means that the traffic will not be blocked; instead, it will be permitted to pass through and will be recorded for monitoring and analysis purposes. This default setting ensures visibility into the traffic and user activities without immediately enforcing a block, allowing for a period of observation and policy tuning before potentially more restrictive actions are taken1.