Your customer is concerned about malware in their AWS S3 buckets. What two actions would help with this scenario? (Choose two.)

To address malware within AWS S3 buckets, Netskope utilizes its API-enabled protection capabilities. The first necessary action is to enable the Threat Protection (Malware Scan) feature for the specific AWS instance configured within the Netskope tenant. This activates the scanning engine. The second action is to create an API Data Protection policy. This policy defines the scope (which S3 buckets to scan) and the response action, such as quarantining any files identified as malware by the scan. Together, these two steps provide a complete solution for detecting and remediating threats at-rest in cloud storage.

A. Create a real-time policy to block malware uploads to their AWS instances.

This addresses inline traffic, preventing new malware uploads, but does not scan or remediate existing malware already in the S3 buckets, which is the core concern.

D. Create a threat profile to quarantine malware in their AWS S3 buckets.

A threat profile is a component used within a policy to define what threats to look for, but it does not perform the quarantine action itself; the API protection policy does.

1. Netskope Official Documentation

"Configure API Data Protection for AWS": This document outlines the procedure for securing AWS services. In the section for setting up an AWS instance

it explicitly states the requirement to enable "Threat Protection" to scan for malware. It then details the subsequent step of creating an "API Data Protection" policy to define actions like "Quarantine" for discovered threats in services like S3. (Reference: Netskope Tenant UI Help Documentation > Configure API Data Protection for AWS > Step 2: Select the services and click Grant Access > Threat Protection checkbox; and Policies > API Data Protection > Policy Wizard).

2. Netskope Official Documentation

"Create an API Data Protection Policy": This guide details the policy creation process. It specifies that for IaaS platforms like AWS

an API Data Protection policy is required. Within the policy configuration

the user selects the cloud app (AWS)

defines the objects to scan (e.g.

S3 buckets)

and sets an action

such as "Quarantine

" based on a selected Threat Protection profile. This confirms that the policy (Option C) is the mechanism for action

not the profile itself (Option D). (Reference: Netskope Tenant UI Help Documentation > Policies > API Data Protection > Create an API Data Protection Policy).