The question requires identifying three native access controls within the Netskope platform for securing privileged user access, without needing third-party integration.

1. IP allowlisting (A) is a native feature allowing administrators to restrict access to the Netskope management UI to a specific set of source IP addresses.

2. Login attempts (B) configuration is part of the native password policy settings, which can lock an administrator's account after a specified number of failed login attempts.

3. Applying roles (C), or Role-Based Access Control (RBAC), is a core, native function that limits an administrator's permissions to only what is necessary for their job, following the principle of least privilege.

These three controls are configured directly within the Netskope tenant's settings.

D. Multi-factor authentication to verify a user's authenticity.

This typically requires integration with an external SAML 2.0 Identity Provider (IdP) like Okta or Azure AD, which violates the "no external or third-party integration" constraint.

E. History-based access control based on past security actions.

This is not a standard, named feature within Netskope for controlling administrative access to the tenant UI. Access controls are primarily role-based, not dynamically history-based for administrators.

1. Netskope Official Documentation

"Role-Based Access Control (RBAC)": This document details the built-in roles (e.g.

Tenant Admin

Read Only Admin

Policy Admin) and the process for creating custom roles. It states

"Netskope provides role-based access control (RBAC) to the Netskope UI. You can assign roles to admin users that have a set of privileges." This supports option C.

2. Netskope Official Documentation

"Configure Security Settings": This section outlines several native security configurations.

Under the "Password Policy" subsection

it describes the ability to "Lockout admin after [N] failed login attempts

" which directly supports option B.

Under the "Allowed IP Addresses" subsection

it explains how to "Add an IP address

range

or subnet to the allowlist for UI and REST API access

" which directly supports option A.

3. Netskope Official Documentation

"Configure SSO for Admin Login": This guide explains that enabling SSO and MFA for administrators involves configuring a SAML 2.0 integration with an external Identity Provider. This confirms that option D requires an external integration

making it an incorrect choice based on the question's constraints.