Netskope Certified Cloud Security Expert (NCCSE) — Question 26

A company's architecture includes a server subnet that is logically isolated from the rest of the network with no Internet access, no default gateway, and no access to DNS. New resources can only be provisioned on virtual resources in that segment and there is a firewall that is tunnel-capable securing the perimeter of the segment. The only requirement is to have content filtering for any server that might access the Internet using a browser.
Which two Netskope deployment methods would achieve this requirement? (Choose two.)

Answer options

• A. Deploy a mobile profile on the servers.
• B. Deploy Data Plane on Premises (DPoP) with a proxy configuration on the servers.
• C. Deploy IPsec or GRE tunnels in the segment to steer traffic from the servers to Netskope.
• D. Install the Netskope Client on the servers.

Correct answer: B, C

Explanation

The correct answers are B and C because deploying Data Plane on Premises (DPoP) with proxy configuration allows for content filtering while accommodating the server's isolated environment, and establishing IPsec or GRE tunnels directs traffic to Netskope for filtering. Options A and D are not suitable as a mobile profile does not provide the necessary filtering capabilities, and the Netskope Client cannot function properly without Internet access or a default gateway.