Discuss Netskope NSK101 Exam Topic 4 Question 3

You are working with traffic from applications with pinned certificates. In this scenario, which statement is correct?

AAn exception should be added to the steering configuration.

BThe domains used by certificate-pinned applications should be added to the authentication bypass list.

CTraffic with pinned certificates should be blocked.

DThe domains used by applications with pinned certificates should be allowed in an inline policy.

Suggested Answer: A

When working with traffic from applications with pinned certificates, you should add an exception to the steering configuration to bypass them. Pinned certificates are a security technique that prevents man-in-the-middle attacks by validating the server certificates against a hardcoded list of certificates in the application. If you try to intercept or inspect the traffic from such applications, they will reject the connection or display an error message. Therefore, you should add the domains used by certificate-pinned applications as exceptions in your steering configuration, so that they are not steered to Netskope for analysis and enforcement.Reference:Certificate Pinned ApplicationsCreating a Steering Configuration

Get Premium NSK101 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

34 comments · newest first

Timothy 10 months ago

D seems logical too, but B feels safer.

Tonja 11 months ago

Isn't it risky to add exceptions?

Chau 11 months ago

Wait, why would we block traffic with pinned certs? Sounds off.

Effie 11 months ago

Definitely agree with that!

Jaclyn 11 months ago

I think option B is the right choice.

Gabriele 12 months ago

I recall that allowing domains in an inline policy is important for certain applications, so option D could be the correct answer here.

Earleen 12 months ago

I’m a bit confused about whether we should block traffic with pinned certificates or allow it. I think blocking might be too strict?

Paris 12 months ago

I feel like I saw a similar question about authentication bypass lists in practice exams. Maybe option B is the right choice?

Benedict 1 year ago

I think I remember that pinned certificates require special handling, but I'm not sure if that means we need to add them to an exception list or something else.

Casie 1 year ago

I'm leaning towards D. Allowing the domains used by the pinned certificate apps in an inline policy could be the right solution, but I'm not 100% confident.

Laurene 1 year ago

Option A seems like the way to go here. Adding an exception to the steering configuration is the best approach for dealing with pinned certificate traffic.

Celestina 1 year ago

Hmm, I'm not sure about this one. I'll need to think it through carefully. Maybe I should review the material on handling pinned certificates again.

Rosina 1 year ago

I think the correct answer is B. The domains used by certificate-pinned applications should be added to the authentication bypass list to allow that traffic to pass through.

Florinda 1 year ago

Got it, that makes sense. I'm feeling more confident now. I'll double-check my work, but I believe the correct answer is B) $120,000.

Tegan 1 year ago

Hmm, I'm not entirely sure about this one. I think I'll try a combination of options C and D to be safe.

Delisa 1 year ago

I feel like this question is similar to one we practiced in class, but the numbers are different. I hope I remember how to calculate the total gross income correctly.

Jonelle 1 year ago

This looks like a straightforward question about Cisco's product lines. I should be able to answer this based on my knowledge of Cisco's networking solutions.

Noah 2 years ago

Candidate 2: That makes sense, it's important to ensure traffic from these applications is not blocked.

Chanel 2 years ago

Candidate 3: We should allow domains used by applications with pinned certificates in an inline policy.

Isadora 2 years ago

Candidate 3: I disagree, I think the answer is D.

Martin 2 years ago

Candidate 1: Because we need to bypass authentication for domains used by certificate-pinned applications.

Rose 2 years ago

Candidate 2: Why do you think that?

Slyvia 2 years ago

Candidate 1: I think the correct answer is B.

Hildred 3 years ago

You know, this reminds me of the time I had to deal with a legacy application that used a hardcoded SSL certificate. Talk about a nightmare! I ended up just throwing the whole thing in the trash and starting over. But I digress, I think the best solution here is to add an exception to the steering config.

Jeniffer 3 years ago

Blocking the traffic with pinned certificates is just going to cause a lot of headaches for the end users. Why not just allow the domains in an inline policy? That way, we can still inspect the traffic and maintain control without disrupting the applications.

Roxanne 3 years ago

I disagree. I think the best approach is to add the domains used by the certificate-pinned applications to the authentication bypass list. That way, we don't have to worry about the pinned certificates at all, and the traffic can flow freely.

Santos 3 years ago

This is a tricky one. The correct answer really depends on how the organization wants to handle certificate-pinned traffic. Personally, I think adding an exception to the steering configuration makes the most sense, as it allows the traffic to flow while still maintaining security controls.

Jerry 2 years ago

↳ replying to Santos

C) Traffic with pinned certificates should be blocked.

Brittni 2 years ago

↳ replying to Santos

Allowing the domains in an inline policy could be another valid option.

Vi 2 years ago

↳ replying to Santos

D) The domains used by applications with pinned certificates should be allowed in an inline policy.

Marjory 2 years ago

↳ replying to Santos

Adding an exception to the steering configuration could also work, as long as it doesn't compromise security.

Johnna 2 years ago

↳ replying to Santos

A) An exception should be added to the steering configuration.

Madonna 2 years ago

↳ replying to Santos

I agree, adding them to the authentication bypass list seems like a practical approach.

Karma 2 years ago

↳ replying to Santos

B) The domains used by certificate-pinned applications should be added to the authentication bypass list.

Netskope NSK101 Exam - Topic 4 Question 3 Discussion