Netskope NSK300 Exam - Topic 7 Question 34 Discussion

Actual exam question for Netskope's NSK300 exam

Question #: 34
Topic #: 7

A company has deployed Explicit Proxy over Tunnel (EPoT) for their VDI users They have configured Forward Proxy authentication using Okta Universal Directory They have also configured a number of Real-time Protection policies that block access to different Web categories for different AD groups so. for example, marketing users are blocked from accessing gambling sites. During User Acceptance Testing, they see inconsistent results where sometimes marketing users are able to access gambling sites and sometimes they are blocked as expected They are seeing this inconsistency based on who logs into the VDI server first.

What is causing this behavior?

AForward Proxy is not configured to use the Cookie Surrogate

BForward Proxy is not configured to use the IP Surrogate

CForward Proxy authentication is configured but not enabled.

DForward Proxy is configured to use the Cookie Surrogate

Show Suggested Answer

Suggested Answer: A

The inconsistent results observed during User Acceptance Testing (where marketing users sometimes access gambling sites and sometimes are blocked) are likely due to the configuration of the Forward Proxy.

Cookie Surrogate: The Cookie Surrogate is a mechanism used in Forward Proxy deployments to maintain user context across multiple requests. It ensures that user-specific policies are consistently applied even when multiple users share the same IP address (common in VDI environments).

Issue: If the Forward Proxy is not configured to use the Cookie Surrogate, it may lead to inconsistent behavior. When different users log into the VDI server, their requests may not be associated with their specific user context, resulting in varying policy enforcement.

Solution: Ensure that the Forward Proxy is properly configured to use the Cookie Surrogate, allowing consistent policy enforcement based on individual user identities.Reference:

Netskope Security Cloud Operation & Administration (NSCO&A) - Classroom Training

Netskope Security Cloud Introductory Online Technical Training

Netskope Architectural Advantage Features

by Lorean at Jul 10, 2025, 03:19 AM

Limited Time Offer

25%

Off

Get Premium NSK300 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Leanora

2 months ago

I've seen this happen before, it's usually the IP Surrogate that's the problem.

upvoted 0 times

...

Dick

2 months ago

Not so sure about that, could be the authentication not being enabled.

upvoted 0 times

...

Rory

3 months ago

I think it's definitely the Cookie Surrogate issue.

upvoted 0 times

...

Dorinda

3 months ago

Wait, are they really blocking gambling sites for marketing? That's surprising!

upvoted 0 times

...

Lyla

3 months ago

Sounds like a classic case of misconfigured proxies.

upvoted 0 times

...

Levi

3 months ago

I feel like the Cookie Surrogate is involved somehow, but I can't recall the exact details. It might be worth considering option D.

upvoted 0 times

...

Lillian

4 months ago

This situation seems familiar; I think we had a similar question about authentication not being enabled. Could that be the cause?

upvoted 0 times

...

Lynette

4 months ago

I'm not entirely sure, but I think if the Forward Proxy isn't using the IP Surrogate, it could lead to inconsistent behavior like this.

upvoted 0 times

...

Clay

4 months ago

I remember we discussed how Cookie Surrogates can affect user sessions in our last practice exam. Maybe that's the issue here?

upvoted 0 times

...

Viola

4 months ago

I'm not sure about this one. There are a lot of moving parts, and I'm not entirely clear on how they all fit together. I'll need to carefully review the question and the answer choices to try to eliminate the incorrect options.

upvoted 0 times

...

Melina

4 months ago

Okay, I've got this. The issue is clearly with the Forward Proxy configuration. It's not using the Cookie Surrogate, which is causing the inconsistent behavior when different users log in. I'm confident that option A is the correct answer.

upvoted 0 times

...

Hyman

4 months ago

Hmm, I'm a bit confused by all the technical details in this question. I'll need to make sure I understand the concepts of Explicit Proxy over Tunnel, Forward Proxy authentication, and Real-time Protection policies before I can even begin to solve this.

upvoted 0 times

...

Svetlana

5 months ago

This question seems a bit tricky, but I think I have a good strategy. I'll carefully read through the details and try to identify the key factors that could be causing the inconsistent behavior.

upvoted 0 times

...

Lucy

6 months ago

This is a classic case of 'it works on my machine'! I bet they forgot to enable the Forward Proxy authentication. Option C all the way.

upvoted 0 times

...

Leonora

7 months ago

Haha, sounds like the IT team is having a fun time troubleshooting this one! If it were me, I'd start by checking the IP Surrogate settings. Option B seems like a good place to start.

upvoted 0 times

...

Hillary

7 months ago

Hmm, the inconsistent results definitely point to an issue with the surrogate settings. I'm leaning towards option D - the Forward Proxy is configured to use the Cookie Surrogate, which could be causing the problem.

upvoted 0 times

Jesusita

5 months ago

User3: Maybe the Forward Proxy is using the wrong surrogate method.

upvoted 0 times

...

Ilda

5 months ago

User2: I agree, it could be related to how the Forward Proxy is configured.

upvoted 0 times

...

Susana

6 months ago

User1: I think the issue might be with the surrogate settings.

upvoted 0 times

...

Rodolfo

7 months ago

I believe option A) makes sense, as not using the Cookie Surrogate could lead to inconsistent results.

upvoted 0 times

...

Jose

7 months ago

Maybe the Forward Proxy is not using the Cookie Surrogate as it should.

upvoted 0 times

...

Callie

7 months ago

I agree, it could be related to how the authentication is set up.

upvoted 0 times

...

Nana

7 months ago

This sounds like a tricky issue. I think the problem is that the Forward Proxy authentication is not enabled, so the Real-time Protection policies are not being applied consistently. Option C seems like the most likely answer.

upvoted 0 times