CCSA NCCSA Practice Test

NCCSA practice test: what's covered

• Cloud Security Administrator
• SASE / SSE

Free NCCSA sample questions

1. A customer asks how Netskope inspects encrypted SaaS traffic with single-digit-millisecond added latency across 70+ regions. Which architectural component is MOST directly responsible for that data-plane proximity?

   • A. Cloud XD JSON parser
   • B. NewEdge — Netskope's private global security cloud with single-pass inspection at each PoP, all PoPs interconnected over Netskope-operated backbone
   • C. The Zero Trust Engine (ZTE) running in the tenant's home region
   • D. The Netskope Client tunnel back-haul to the tenant's primary data centre
   Show answer

   Correct: B. NewEdge is Netskope's purpose-built private cloud. Unlike competitors who run on public IaaS, every NewEdge data centre carries the full stack (SWG/CASB/ZTNA/DLP/ATP) and PoPs peer richly with SaaS providers. Cloud XD is the inspection engine running ON NewEdge; ZTE is the policy decision plane. Back-haul to a single home region is the OPPOSITE of NewEdge's design.

2. An admin sees this inspection event excerpt in Skope IT: <pre>{ "app": "Microsoft OneDrive for Business", "activity": "Upload", "object": "Q3-financials.xlsx", "from_user": "alice@acme.com", "to_user": "external-vendor@partner.io", "instance_id": "acme-corp-tenant", "cci": 95, "ccl": "high" }</pre> Which Netskope engine produced the structured "activity / object / from_user / to_user" fields?

   • A. The Netskope Steering Client local hooks
   • B. Cloud XD (Cloud eXtensible Definition) — parses thousands of SaaS APIs in real time to extract user/activity/object metadata from arbitrary HTTPS payloads
   • C. The Cloud Confidence Index database
   • D. NPA Publisher telemetry
   Show answer

   Correct: B. Cloud XD is the JSON-level deep inspection that turns opaque HTTPS into structured app/instance/user/activity/object fields, which then feed CASB policy. CCI provides a static risk SCORE per app (cci:95) — it does NOT extract per-transaction metadata. The Steering Client only delivers traffic; NPA Publisher serves private apps.

3. Which TWO planes does the Netskope Zero Trust Engine (ZTE) evaluate on every transaction to make a real-time allow/block/coach decision? (Choose 2)

   • A. User identity + device posture (managed vs unmanaged, OS patch level, certificate)
   • B. The downstream SaaS provider's subscription tier
   • C. App instance context + activity + data sensitivity (DLP/CCI/CCL)
   • D. The tenant's billing region
   Show answer

   Correct: A and C. ZTE fuses identity+device posture (the who/where) with app+activity+data context (the what) into a single policy decision. Billing region and SaaS subscription tier are not policy inputs. The 5-tuple Zero Trust pattern Netskope advertises: User, Device, App, Activity, Data — these map to the two correct choices.

4. During tenant onboarding the integrator asks: "Is Netskope multi-tenant, and where is my data stored?" The MOST accurate answer is:

   • A. Netskope is single-tenant — every customer gets a dedicated VM
   • B. Multi-tenant on shared NewEdge infrastructure, but data is logically segregated per tenant; the tenant chooses a Home Region (e.g., EU, US, APAC) for primary log/data residency, with optional sub-region pinning for GDPR / data-sovereignty requirements
   • C. Single-tenant on AWS only
   • D. All tenants share one global database; no residency choice exists
   Show answer

   Correct: B. Multi-tenant on shared compute, dedicated logical segregation, customer-selected home region for log/policy storage. NewEdge is Netskope-owned (not AWS). Single-tenant claims are a common reseller misconception traceable to old CASB designs.

5. Cloud XD distinguishes between an "App" and an "App Instance". Which scenario BEST illustrates the practical value of that distinction?

   • A. Blocking Facebook entirely
   • B. Allowing uploads to the corporate OneDrive instance (acme-corp tenant) while blocking uploads to ANY personal/unsanctioned OneDrive instance — the URL is identical, only the instance_id differs
   • C. Throttling all video streaming
   • D. Logging admin actions only
   Show answer

   Correct: B. App-instance awareness is Netskope's key differentiator vs URL-only SWGs. Corporate OneDrive and personal OneDrive resolve to the same domain; only Cloud XD can read the instance_id from the API metadata and apply differentiated policy. This is THE textbook "managed vs unmanaged tenant" pattern.

Last updated: 2026-09-23

NCCSA practice test FAQ