NSK101

Netskope Certified Cloud Security Administrator (NCCSA)

Part of Netskope Certified Cloud Security Administrator (NCCSA)

Targets: Product version not specified in the blueprint
Blueprint source: Official NCCSA (NSK101) Certification Description; 90 minutes, Pearson VUE; practitioner profile: configure, monitor, and perform basic troubleshooting, ~6 months of practical experience suggested; recommended preparation: NSCIOTT and NSCO&A Academy courses plus a tenant and the Knowledge Portal ↗

Independent study aid built from the public exam blueprint. Not affiliated with, authorized by, or endorsed by netskope. Exam objectives, versions, and availability change, so always verify against the official blueprint.

Cloud Security Concepts

NCCSA-A.01 Cloud security theory
NCCSA-A.02 Common industry compliance standards
NCCSA-A.03 Common cloud service model concepts
NCCSA-A.04 Data-in-motion protection compared to data-at-rest concepts
On this site: Data Loss Prevention: How Machines Recognize Secrets
NCCSA-A.05 Web security concepts
On this site: HSTS and HTTPS Enforcement, HTTP Security Headers: The Defense-in-Depth Layer
NCCSA-A.06 Traffic steering concepts
On this site: Netskope Steering Methods: Getting Traffic to the Cloud That Inspects It, How a PAC File Chooses a Proxy, GRE Tunnels: The Simplest Envelope in Networking, IPsec and IKE: How Encrypted Tunnels Negotiate Themselves
Tools: netskope-steering-decision-explainer, pac-file-explainer

Netskope Platform Concepts Basics

NCCSA-B.01 Deployment modes
On this site: Real-time vs API Protection: The Two Vantage Points of a Security Cloud, HTTP Proxies: Forward vs Reverse, Explicit vs Transparent
NCCSA-B.02 Features and architectural benefits
On this site: Netskope Platform Architecture: One Platform, Two Data Paths, One Private Cloud, Netskope: Cloud Forward Proxy and Inline TLS Decryption
NCCSA-B.03 Security controls
On this site: Netskope Cloud Firewall: Egress Control for Everything That Isn't Web, Data Loss Prevention: How Machines Recognize Secrets, Sandbox Detonation: Judging a File by What It Does, Browser Isolation: When You Cannot Trust the Page, Move the Browser
NCCSA-B.04 Cloud security risk management/reduction

Netskope Platform Management

NCCSA-C.01 Steering traffic to Netskope
On this site: Netskope Steering Methods: Getting Traffic to the Cloud That Inspects It, How a PAC File Chooses a Proxy, GRE Tunnels: The Simplest Envelope in Networking, IPsec and IKE: How Encrypted Tunnels Negotiate Themselves
Tools: netskope-steering-decision-explainer, pac-file-explainer
NCCSA-C.02 Basic configuration elements
NCCSA-C.03 Real-time inline or API policy configuration concepts
On this site: Real-time vs API Protection: The Two Vantage Points of a Security Cloud
NCCSA-C.04 Basic administration tasks
On this site: SCIM: The Standard That Provisions the Accounts SSO Signs In

Netskope Platform Monitoring

NCCSA-D.01 Identifying cloud risk using the Cloud Confidence Index (CCI)
On this site: The Cloud Confidence Index: Scoring the Apps Your Users Already Found
NCCSA-D.02 Event monitoring
On this site: Netskope Events and Advanced Analytics: From Traffic to Evidence

Netskope Platform Troubleshooting

NCCSA-E.01 Common steering issues
On this site: Netskope Steering Methods: Getting Traffic to the Cloud That Inspects It, Netskope Client Deployment: Enrollment, Identity, and the Tunnel, How a PAC File Chooses a Proxy
Tools: netskope-steering-decision-explainer, pac-file-explainer
NCCSA-E.02 Policy-related misconfigurations
NCCSA-E.03 TLS decryption-related issues
On this site: Netskope: Cloud Forward Proxy and Inline TLS Decryption, SSL Forward Proxy: How Outbound TLS Interception Works and What Breaks It
NCCSA-E.04 Collect log files used for service requests
On this site: Netskope Client Deployment: Enrollment, Identity, and the Tunnel