Discuss Netskope NSK200 Exam Topic 3 Question 30

You are given an MD5 hash of a file suspected to be malware by your security incident response team. They ask you to offer insight into who has encountered this file and from where was the threat initiated. In which two Skope IT events tables would you search to find the answers to these questions? (Choose two.)

AApplication Events

BNetwork Events

CAlerts

DPage Events

Suggested Answer: A, C

To find the answers to the questions posed by the security incident response team, you need to search in the Application Events and Alerts tables in Skope IT. The Application Events table shows the details of the cloud application activities performed by the users, such as upload, download, share, etc.You can filter the Application Events table by the MD5 hash of the file to find out who has encountered this file and from which cloud service it was downloaded1. The Alerts table shows the details of the policy violations triggered by the users, such as DLP, threat protection, anomaly detection, etc.You can filter the Alerts table by the MD5 hash of the file to find out if this file was detected as malware by Netskope and what action was taken2. Therefore, options A and C are correct and the other options are incorrect.Reference:Application Events - Netskope Knowledge Portal,Alerts - Netskope Knowledge Portal

Get Premium NSK200 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

33 comments · newest first

Jeanice 10 months ago

Sounds too easy, what if the info is hidden somewhere else?

Carla 11 months ago

I agree, Network Events is a must!

Thurman 11 months ago

Wait, are we sure about that? What if it’s in Alerts?

Lashon 11 months ago

I think Application Events are key too!

An 11 months ago

Definitely check the Network Events for the source.

Franchesca 12 months ago

I’m leaning towards Network Events and Alerts, but I’m a bit uncertain about the Alerts table. Did we cover that in our last review?

Ilda 12 months ago

I feel like Application Events might be relevant too, but I can't recall if it directly ties to malware detection.

Emerson 12 months ago

I remember practicing with similar questions, and I think the Alerts table could be useful for identifying who encountered the file.

Viola 1 year ago

I think we should look at the Network Events table to see where the threat originated, but I'm not sure about the second one.

Emmanuel 1 year ago

This seems like a tricky one, but I think the key is to focus on the security-related tables. The Network Events and Alerts tables are likely the best places to start searching for information about the malware incident.

Justine 1 year ago

I'm a bit confused by this question. I'm not sure which tables would have the information they're looking for. Maybe the Application Events and Page Events tables could be relevant, but I'm not entirely sure.

Wenona 1 year ago

Okay, let's see. The question is asking about a security incident, so the Network Events and Alerts tables seem like the most relevant places to look. I'll focus on those two.

Shaun 1 year ago

Hmm, I'm not sure about this one. I'll need to think it through carefully. The Alerts table might also have relevant information, but I'm not confident that's the right answer.

Francis 1 year ago

This seems like a straightforward question. I'd start by checking the Application Events and Network Events tables, as those are likely to contain information about the file and where it was encountered.

Felicidad 2 years ago

This is a classic security incident response scenario. Good thing they didn't ask us to actually analyze the MD5 hash - that would be way above my pay grade!

Jacquelyne 2 years ago

↳ replying to Felicidad

B) Network Events

Malissa 2 years ago

↳ replying to Felicidad

B) Network Events

Carmen 2 years ago

↳ replying to Felicidad

A) Application Events

Paris 2 years ago

↳ replying to Felicidad

A) Application Events

Aaron 2 years ago

Haha, I bet the security team wishes they could just search the 'Catch All the Bad Guys' table! But in reality, Alerts and Network Events are the way to go.

Iluminada 2 years ago

↳ replying to Aaron

B) Network Events

Ezekiel 2 years ago

↳ replying to Aaron

A) Application Events

Latonia 2 years ago

I would also consider looking in Application Events table for more insights.

Keena 2 years ago

I agree with Gilma, those tables would have the information we need.

Chauncey 2 years ago

Hmm, I was thinking D) Page Events might also be relevant since the malware could have been downloaded from a web page. But I guess the Alerts and Network Events tables make more sense.

India 2 years ago

↳ replying to Chauncey

B) Network Events

Page 2 years ago

↳ replying to Chauncey

A) Application Events

Shanda 2 years ago

The correct answer is definitely C) Alerts and B) Network Events. Those are the tables that would contain information about suspicious activity and network traffic related to the suspected malware file.

Melynda 2 years ago

↳ replying to Shanda

After that, we can move on to Network Events to track the source of the threat.

Hubert 2 years ago

↳ replying to Shanda

Let's start by analyzing the data in Alerts first.

Beckie 2 years ago

↳ replying to Shanda

Agreed, we should also look into Network Events for information on where the threat originated.

Ruby 2 years ago

↳ replying to Shanda

I think we should check Alerts for any suspicious activity.

Gilma 2 years ago

I think I would search in Network Events and Alerts tables.

Netskope NSK200 Exam - Topic 3 Question 30 Discussion