A customer wants to use Netskope to prevent PCI data from leaving the corporate sanctioned OneDrive instance. In this scenario. which two solutions…

To prevent PCI data exfiltration from a sanctioned OneDrive instance, a comprehensive approach covering data-at-rest and data-in-motion is required. Netskope's API Data Protection connects directly to the OneDrive API to scan all existing data (data-at-rest). It can identify files containing PCI data and apply remediation actions, such as revoking public sharing links or quarantining files, to prevent exposure.

Simultaneously, Real-time Protection provides inline inspection for data-in-motion. As users upload, download, or share files, Netskope inspects the traffic and content in real-time, blocking any transaction that violates the PCI data policy before the exfiltration is complete. Together, these solutions provide robust protection.

B. Cloud Firewall (CFW): Incorrect. CFW provides network-level egress control (L3/L4/L7) for non-web traffic and is not the primary tool for deep content inspection within sanctioned SaaS applications.

C. SaaS Security Posture Management (SSPM): Incorrect. SSPM audits the security configuration settings of the SaaS application itself (e.g., sharing policies), but it does not inspect the actual data content for sensitive information like PCI.

1. Netskope Official Documentation

"About API Data Protection": This document describes the functionality of API Data Protection

stating

"Netskope API Data Protection scans your sanctioned SaaS apps...for data exposure and threats. After discovering policy violations

you can take remedial actions

like...quarantine

and more." This directly supports its role in finding and securing PCI data at rest in OneDrive.

2. Netskope Official Documentation

"Real-time Protection Policies": This source details the inline capabilities. It explains

"A Real-time Protection policy allows you to monitor and control user activities in sanctioned and unsanctioned apps." This includes creating DLP policies to "Block" uploads or shares of sensitive data like PCI

directly addressing the prevention of data exfiltration in motion.

3. Netskope Solution Brief

"Netskope for Microsoft 365": This document outlines the dual approach. It highlights the need for both "API-enabled protection to find and secure sensitive data-at-rest" and "inline real-time policy controls to protect data-in-motion." This confirms that API Data Protection and Real-time Protection are the two core solutions for this use case. (Reference: See sections on "Stop data exfiltration" and "Secure data at rest").