Click the Exhibit button. A user has the Netskope Client enabled with the correct steering configuration applied. The exhibit shows an inline policy…

The most direct cause for an inline policy failing to block traffic, when steering is confirmed to be working, is a mismatch in the policy criteria. The policy is configured to block the "Webmail" category. The user's ability to access Yahoo Mail indicates that, for this specific transaction, the traffic was not classified as belonging to the "Webmail" category by the Netskope security cloud. Therefore, the policy condition was not met, and the "Block" action was not triggered. This can sometimes be influenced by the specifics of the traffic steering method, such as an explicit proxy.

A. The user is not part of the correct AD group or OU.

This is incorrect because the policy's source is set to "All Users," which means it applies to everyone regardless of their Active Directory group or OU membership.

B. The user is not steered using an explicit proxy.

This is incorrect because the problem is related to policy evaluation, not the method of steering. The question states the steering configuration is correct, implying traffic is reaching Netskope.

D. The user's AD group must be added to the policy.

This is incorrect. The policy already applies to the widest possible scope ("All Users"), so adding a more specific group would not resolve an issue for a user already included.

1. Netskope Official Documentation

"Real-time Protection Policies": This documentation outlines that for a policy to be enforced

the user traffic must match all specified criteria

including Source

Destination

and Category. In this scenario

the "Category" criterion is not being met. (Reference: Netskope Tenant UI Help Documentation

section on Policies > Real-time Protection > New Policy).

2. Netskope Official Documentation

"Steering Configuration": The Netskope Client can steer traffic via multiple methods. While the method can affect how traffic is presented to the Netskope cloud for inspection

the fundamental reason for policy failure in this case is the categorization mismatch

not the steering method itself. (Reference: Netskope Client Configuration Guide

Section 3: "Steering Configurations").

3. Netskope Official Documentation

"URL Category Definitions": Policy enforcement is contingent upon the URL's classification. If mail.yahoo.com is not categorized as "Webmail" during the transaction

a policy blocking that category will not apply. (Reference: Netskope Tenant UI Help Documentation

section on Policies > Web > URL Categories).