Your company has implemented Netskope's Cloud Firewall and requires that all FTP connections are blocked regardless of the ports being used. Which…

The objective is to block all FTP connections, irrespective of the port used.

Option A is a correct method because Netskope's Cloud Firewall is application-aware. By creating a Real-time Protection policy that targets the predefined 'FTP' application, the firewall uses deep packet inspection and protocol analysis to identify and block FTP traffic, regardless of the destination port. This is the most precise and direct way to meet the requirement.

Option C is also a correct method that implements a default-deny security posture. The Netskope Cloud Firewall processes rules in order, and if no specific rule matches, a default rule is applied. By setting the default action for non-web traffic to 'Block', any FTP connection (which is non-web) that is not explicitly allowed by a higher-priority rule will be blocked on any port.

B: This policy is port-based, only blocking the standard FTP command port (TCP 21). It would fail to block FTP traffic operating on non-standard ports.

D: Steering Configuration exceptions are used to bypass Netskope inspection for specified traffic. This would prevent the Cloud Firewall from ever seeing or blocking the FTP connections.

1. Netskope Official Documentation

"Cloud Firewall": The Cloud Firewall documentation outlines its capability as an application-aware

next-generation firewall. It states

"Netskope Cloud Firewall (CFW) provides centralized management and granular control of non-web traffic... You can create policies to allow or block access to specific services based on users

groups

locations

devices

applications

and ports." This supports the application-based policy approach in option A. (Reference: Netskope Tenant UI Help Documentation

Cloud Firewall section).

2. Netskope Official Documentation

"Add a Real-time Protection Policy": This documentation details the process of creating policies. In the policy wizard

under the "Application" criteria

administrators can select from a list of predefined applications

including 'FTP'. This confirms that policies can be built to target the protocol itself

making them port-agnostic as described in option A. (Reference: Netskope Tenant UI Help Documentation

Policies > Real-time Protection > Add a Real-time Protection Policy).

3. Netskope Official Documentation

"Firewall Default Rule": The documentation on Cloud Firewall rule processing explains that a default rule is processed last. It can be configured to either allow or block traffic that does not match any of the preceding custom rules. Setting this default to 'Block' for non-web traffic is a standard security practice for a default-deny stance

which supports the method described in option C. (Reference: Netskope Tenant UI Help Documentation

Policies > Firewall > Default Rule section).