While most Web and SaaS traffic is decrypted for inspection, you are asked to prevent a certain host on the network from SSL decryption for privacy…

The most precise and appropriate method to prevent SSL decryption for a specific host is to create an SSL Decryption policy. This involves defining the host's IP address as a "Source Network Location" and then creating a policy rule with the action "Do Not Decrypt" that applies specifically to that location. This approach ensures that traffic from the host is still steered to the Netskope security cloud for other policy enforcement (like URL filtering), but the TLS session is not intercepted for deep inspection, thus meeting the privacy requirement without completely bypassing all security controls.

A. Create a steering exception for the host.

This is incorrect because a steering exception bypasses the Netskope proxy entirely for the host, preventing all inspection and policy enforcement, not just SSL decryption.

B. Create a Real-time Protection policy, select the host, and choose to block SSL decryption.

This is incorrect as Real-time Protection policies do not have an action to "block SSL decryption." Their actions are focused on controlling access and activities (e.g., Allow, Block, Alert).

D. Add the host to the certificate-pinned application list.

This is incorrect because certificate-pinned application exceptions apply to destinations (applications/websites) that break when decrypted, not to source hosts on the network.

1. Netskope Official Documentation

"SSL Decryption": This document details the process of creating SSL Decryption policies. It explicitly states that policies can be configured with a "Do Not Decrypt" action and can be targeted based on various criteria

including "Source Location." This directly supports creating a policy to exempt a specific source from decryption. (Accessed via Netskope Support Portal

Policies > SSL Decryption > Add Policy).

2. Netskope Official Documentation

"Network Location": This documentation explains how to define network locations based on IP addresses or ranges. It clarifies that a "Source Location" can be used as a criterion in policies to identify traffic originating from specific IPs

such as the host in the question. (Accessed via Netskope Support Portal

Settings > Security Cloud Platform > Network Locations).

3. Netskope Official Documentation

"Steering Configuration": This source describes steering exceptions. The documentation clarifies that exceptions are used to bypass traffic from the Netskope proxy

which is a fundamentally different and broader action than selectively choosing not to decrypt traffic within a policy. (Accessed via Netskope Support Portal

Settings > Security Cloud Platform > Steering Configuration > Exceptions).