Free NSK200 Practice Test Questions and Answers (2026) Practice Questions

To inspect outbound SMTP email traffic from a sanctioned application like Microsoft Exchange Online for data loss, the correct Real-time Protection policy type is "Email Outbound". This policy is specifically designed to intercept and apply controls, such as Data Loss Prevention (DLP) scanning for Personal Health Information (PHI), to emails being sent from the configured cloud service to external recipients. The policy allows administrators to define conditions based on the email source, destination, and content, and then apply a DLP profile to enforce the desired action.

A. Web Access policy: This policy type is used for inspecting and controlling user activities over HTTP/HTTPS web traffic, not for SMTP email traffic.

C. CTEP policy: Cloud Threat and Error Protection (CTEP) is a Cloud Security Posture Management (CSPM) feature that identifies cloud service misconfigurations, not for real-time inspection of data within emails.

D. DLP policy: While the goal is to use DLP, "DLP policy" refers to the creation of DLP rules and profiles. These profiles are then applied to a real-time enforcement policy, such as an "Email Outbound" policy, to be effective.

1. Netskope Official Documentation

"Real-time Protection Policies": The documentation outlines the different types of Real-time Protection policies. It specifies that "Email Outbound" policies are used to "monitor and control outbound emails sent from sanctioned enterprise SaaS apps." This directly matches the scenario of scanning emails from Exchange Online. (Accessed via Netskope's official documentation portal

docs.netskope.com

under the "Policies > Real-time Protection" section).

2. Netskope Official Documentation

"Create a Real-time Protection Policy": This guide details the steps for policy creation. When creating a new policy for data in motion

the first step is to select the traffic type. For SMTP

the designated type is "Email Outbound". The guide then explains how to add a DLP profile to this policy under the "Action" settings. (Accessed via docs.netskope.com

specific instructions are found in the "Create a Real-time Protection Policy" workflow).

3. Netskope Official Documentation

"SaaS API Data Protection Prerequisites": While discussing API protection

this document helps differentiate traffic types. It clarifies that real-time inspection of email traffic (SMTP) requires a Real-time Protection policy

specifically "Email Outbound

" distinct from API-based introspection of data-at-rest. (Accessed via docs.netskope.com

under the "SaaS Security Posture Management > SaaS API Data Protection" section).

In Netskope's Skope IT, the accessmethod filter is used to differentiate the source of traffic and events. To isolate events originating specifically from endpoints with the Netskope agent installed, the correct filter value is Client. This action effectively filters out events from other sources, such as API-based policies (API Connector), network tunnels (IPsec, GRE), or other forwarding methods. Selecting Client directly achieves the user's goal of viewing only logs generated by the Netskope client.

B. The Tunnel value for the accessmethod filter would show traffic forwarded from network-level IPsec or GRE tunnels, not from the endpoint client.

C. Logs is not a valid or recognized value for the accessmethod filter within the Skope IT interface.

D. Using the neq (not equal) operator would show all events except those from the Netskope client, which is the opposite of the stated requirement.

1. Netskope Official Documentation

"Skope IT Filters": This document details the available filters within the Skope IT interface. It explicitly lists Access Method as a primary filter and Client as a value to isolate traffic steered by the Netskope Client. It also defines other access methods like API Connector

IPsec

and GRE

confirming why the other options are incorrect. (Accessed via Netskope Support Portal

specific document ID varies with version).

2. Netskope Official Documentation

"Skope IT Page Overview": This guide explains the functionalities of the Skope IT pages (Application Events

Alerts

Page Events

Network Events). It describes how to build queries using filters like accessmethod to narrow down results. The documentation confirms that accessmethod: Client is the standard query syntax for filtering client-generated traffic. (Accessed via Netskope Support Portal).

The Netskope predefined identifier "Card Numbers (Major Networks; all)" is designed to minimize false positives by incorporating validation checks. It uses the Luhn algorithm (mod 10 checksum) to verify that a detected number is a mathematically valid credit card number. If the data used for testing contains number sequences that resemble credit card numbers but do not pass this algorithm, the DLP engine will not classify them as a match. Therefore, for a policy hit to be observed, the test data must contain credit card numbers that are valid in their structure and pass the checksum.

A. DLP policies can be applied to real-time traffic from various steering methods (e.g., Netskope Client, tunnels), not exclusively through API protection for data-at-rest.

C. The Netskope DLP engine can detect card numbers in various formats, including those with spaces or dashes, and does not require manual data normalization.

D. The Netskope Client is one of several methods for DLP inspection; it is not a mandatory requirement. Optical character recognition (OCR) is irrelevant for detecting card numbers in text.

1. Netskope Official Documentation

"Predefined Data Identifiers": This document details the predefined identifiers available in Netskope DLP. For sensitive identifiers like Credit Card Numbers

it specifies that validation

such as the Luhn algorithm

is used to increase detection accuracy. (Accessed via Netskope Support Portal

specific document ID varies with version

but the content is standard in the DLP section).

2. Netskope Official Documentation

"About Data Loss Prevention": This documentation explains that Netskope DLP inspects content from multiple traffic sources

including the Netskope Client for managed devices

secure web gateway for unmanaged devices

and API connectors for SaaS applications. This confirms that neither the client nor API protection is the sole method for DLP. (Found under the "Data Loss Prevention" section in the main product documentation).

The primary requirement is to create a role that provides user privacy by avoiding the direct exposure of user identities and location information. To achieve this, the following fields must be obfuscated:

1. User names: This is a direct personal identifier and must be hidden to protect user identity.

2. Source location information: This field explicitly contains the user's geographical location and must be obfuscated to protect their location privacy.

3. User IPs: A user's IP address can be used to infer their location through geolocation and can also be used to correlate activity back to a specific individual, thus compromising both identity and location privacy.

C. App names, URLs, and destination IPs: This information relates to the destination of user traffic, not the user's personal identity or source location.

D. File and object names: This pertains to the data being accessed. While it could contain sensitive information, it does not directly identify the user or their location.

1. Netskope Official Documentation

"Role-Based Access Control (RBAC)": In the section describing the creation of custom roles

the "Obfuscation" settings are detailed. The documentation specifies that obfuscating "User names

" "User IPs

" and "Source location information" are the controls used to anonymize user identity and location details within the platform's reports and event logs. This directly aligns with the scenario's requirement for user privacy. (Accessed via Netskope Support Portal

specific document version may vary).

The Netskope DLP Incident workflow, accessible via Skope IT > Incidents > DLP, is the centralized console for managing Data Loss Prevention incidents. This interface is specifically designed for administrators to review, analyze, and manage the lifecycle of DLP incidents. A core function of this workflow is the ability to assign incidents to specific owners (i.e., team members) for investigation, follow-up, and remediation. This ensures accountability and streamlines the incident response process directly within the Netskope platform.

A. Use your ticketing tool.

While Netskope can integrate with external ticketing tools, this is not the native, built-in method for incident assignment. The question implies a direct action within the Netskope platform.

B. Use the Forensic Incident workflow.

The Forensics feature is used to create profiles that capture detailed, granular information for future analysis of specific activities. It is not used for assigning existing incidents.

D. Use the Quarantine Incident workflow.

This workflow is specifically for managing files that have been placed in quarantine. It is a component of incident response but not the primary interface for assigning all types of DLP incidents.

1. Netskope Official Documentation

"About Incidents": This document outlines the different types of incidents

including DLP

and directs users to the Skope IT > Incidents page for management. The DLP section is the specific location for these tasks. (Accessed via Netskope Support Portal

specific document ID varies with version).

2. Netskope Official Documentation

"Managing DLP Incidents": This guide explicitly details the actions available on the DLP incidents page. It describes the process of selecting one or more incidents and using the "Actions" dropdown menu to "Assign Owner

" which directly addresses the user's requirement. (Accessed via Netskope Support Portal).

3. Netskope Training Courseware

"Netskope Security Cloud Administrator": The module on Incident Management demonstrates the workflow for triaging alerts. It shows that assigning an owner is a primary step performed directly on the Skope IT > Incidents > DLP page to delegate investigation tasks.

Netskope provides several methods for user and group provisioning. System for Cross-domain Identity Management (SCIM) is an open standard that automates user provisioning from Identity Providers (IdPs) like Azure AD or Okta, and it explicitly supports the synchronization of both users and groups. The Netskope Directory Importer is a dedicated, lightweight tool designed to connect to on-premises Active Directory or LDAP servers to read and upload user and group information directly into the Netskope platform. Both methods are designed to import and maintain user and group structures from an authoritative source.

B. Use Manual Entries: This method is for creating individual users or custom groups directly in the UI. It is not a method for importing existing directory objects in bulk.

D. Use Bulk Upload with a CSV file: The CSV bulk upload feature is designed primarily for provisioning users. While it can assign users to existing groups, it does not import or create the group objects themselves.

1. Netskope Official Documentation

"User Provisioning": This document outlines the primary methods for getting user and group information into the Netskope platform. It explicitly lists SCIM and Directory Importer as key methods. It describes the Directory Importer as a tool to "upload user and group information from your Active Directory to the Netskope cloud."

Source: Netskope Tenant UI > Help > Netskope Help > Platform Configuration > User Provisioning.

2. Netskope Official Documentation

"SCIM Integration": This section details the SCIM protocol's use with Netskope. It states

"Netskope supports SCIM to provision users and groups from your identity provider (IdP) into Netskope." This confirms SCIM's capability for both entity types.

Source: Netskope Tenant UI > Help > Netskope Help > Platform Configuration > User Provisioning > SCIM Integration.

3. Netskope Official Documentation

"Directory Importer for Active Directory": This guide provides details on the Directory Importer tool. The overview section states its purpose is to "upload user and group information from your Active Directory to the Netskope cloud

" confirming it handles both users and groups.

Source: Netskope Tenant UI > Help > Netskope Help > Platform Configuration > User Provisioning > Directory Importer for Active Directory.

For the Netskope Client to function correctly, it must establish a secure tunnel to the Netskope cloud infrastructure. The primary communication channel is a TLS tunnel over TCP port 443, which is a mandatory requirement. Therefore, firewall rules must permit this traffic to the designated Netskope IP ranges or domains. For optimal performance, especially with latency-sensitive applications, the Netskope Client also attempts to establish a DTLS tunnel over UDP port 443. While the client can fall back to TCP-only, allowing UDP is a highly recommended best practice to ensure the best user experience.

A. Netskope requires modern, secure protocols like TLS 1.2 or higher. TLS 1.1 is deprecated and insecure. Also, rules should be scoped to Netskope destinations, not "all destinations".

B. The Netskope Client's tunnel to the cloud is secured with certificate pinning. Enabling SSL decryption on a proxy to inspect this tunnel will break the trust and cause the connection to fail.

1. Netskope Support Portal

"Netskope Client Networking Requirements": This document explicitly states the need to allow traffic to Netskope domains and IP ranges. It details that TCP port 443 is required for the primary tunnel (TLS) and that UDP port 443 is recommended for the secondary

performance-enhancing tunnel (DTLS).

2. Netskope Support Portal

"Add Netskope Exceptions to your Firewall": This guide provides the specific domains and IP addresses that need to be allowed. It confirms that "TCP/UDP Port 443" should be open for these destinations

reinforcing that both protocols are used.

3. Netskope Support Portal

"Certificate Pinning": This article explains that Netskope services

including the client

use certificate pinning to prevent man-in-the-middle attacks. This directly contradicts the idea of using a proxy to decrypt the client's tunnel

as it would be treated as a security violation

causing the connection to be terminated.

The System for Cross-domain Identity Management (SCIM) protocol, used for provisioning, treats users and groups as distinct objects. A group object contains references to its member user objects. For a group to be successfully provisioned or updated in a target application like Netskope, the user objects referenced as its members must already exist within that application. If you attempt to push a group from an Identity Provider (IdP) before its constituent users have been individually provisioned, the Netskope SCIM endpoint will be unable to resolve the user references, causing the group provisioning operation to fail. This is a fundamental dependency and a common procedural error in SCIM configuration.

A. While a deactivated user could cause an issue in some specific IdP implementations, the more fundamental problem is whether the user object exists in Netskope at all, regardless of its active status.

B. The question states that the API integration settings are "correct and functional," which implies that the necessary permissions, including user creation, have been successfully validated and are in place.

C. SCIM and Netskope's provisioning service do not enforce a minimum number of users for a group to be created. An empty group or a group with a single user can be provisioned.

1. Netskope Technical Documentation

"Configure SCIM for Okta": The procedural steps outlined in the official configuration guide require assigning users to the Netskope application before pushing groups. The guide states

"After you assign users and groups to the Netskope app in Okta

they will be provisioned in the Netskope tenant." This implies a sequence where users must be provisioned to be available for group membership. The "Push Groups" tab is configured after the initial user provisioning is established. (Accessed via Netskope Support Portal).

2. Netskope Technical Documentation

"SCIM Troubleshooting Guide": A common troubleshooting point for failed group pushes is "Error: 'User not found' when updating group membership." The documented cause is that the user being added to the group does not exist in the Netskope tenant. The resolution is to "Ensure the user is provisioned to Netskope before adding them to a group." This directly supports the principle that users must be pushed before groups. (Accessed via Netskope Support Portal).

3. IETF RFC 7644

"System for Cross-domain Identity Management: Protocol"

Section 3.3: The SCIM protocol defines group members as references to User resources. The specification notes

"The 'value' sub-attribute of a 'members' attribute is a URI that references a specific User resource...". This standard underpins the requirement that the referenced User resource must exist and be resolvable by the service provider (Netskope) for the group membership to be valid.

The goal is to gain visibility into the native Dropbox client's traffic without blocking it. The most effective way to achieve this within the Netskope platform is to ensure the traffic is steered to the Netskope Security Cloud for inspection. A steering exception of the type "Destination Locations" allows an administrator to specifically target traffic destined for the Dropbox application. By creating this exception and ensuring the action is set to steer (e.g., "Tunnel"), the Netskope Client on user devices will be instructed to send all traffic from the native Dropbox client through the Netskope cloud. This provides the required visibility for policy enforcement and monitoring.

A. Changing the default action for all steering exceptions to Tunnel mode is overly broad and could have unintended consequences for other applications. The configuration should specifically target Dropbox.

B. This option directly contradicts the requirement "you do not want to prevent the use of Dropbox." Blocking the native client is not the stated goal; visibility is.

C. Removing Dropbox entries from the steering configuration would likely cause the Netskope Client to bypass Dropbox traffic, sending it directly to the internet and preventing any visibility.

1. Netskope Official Documentation

"Steering Configuration": This document outlines the methods for managing traffic steering. It specifies that "Destination Locations" is an exception type used to define rules for traffic going to specific applications

domains

or IP addresses. To ensure visibility for a specific app like Dropbox

an administrator would create an exception for it under this category. (Accessed via Netskope Support Portal

specific page: Settings > Security Cloud Platform > Steering Configuration > Exceptions Tab).

2. Netskope Official Documentation

"Add a Steering Exception": This guide details the process of creating exceptions. It states

"For Destination Locations

you can add domains

IP addresses

and predefined applications and categories." This confirms that creating a "Destination Locations" exception is the correct procedure for targeting a predefined application like Dropbox to control its steering behavior. (Accessed via Netskope Support Portal

specific page: Steering Configuration > Add a Steering Exception).

To create a report on accessed unsanctioned applications, the security analyst needs data sources that log user interactions with cloud applications.

Page Events: This data collection logs every instance of a user visiting a web page or cloud application. It is the primary source for Cloud Application Analytics and discovering "Shadow IT," as it captures all initial access attempts and contains essential attributes like application name and category.

Application Events: This collection logs specific, decoded user activities within cloud applications, such as 'login', 'upload', 'share', or 'download'. These events also constitute application "access" and provide deeper insight into how the applications are being used.

Combining both provides the most comprehensive view of application usage.

A. Alerts: This collection only records events that have explicitly violated a configured policy. It does not provide a complete view of all application access, only the ones that triggered an alert.

D. Network Events: This collection contains Layer 3/4 information like IP addresses and ports. It lacks the application-layer context required to identify specific cloud applications and their categories.

1. Netskope Official Documentation

"Advanced Analytics Data Collection":

Page Events Section: "A page event is generated when a user visits a web page... This is useful for Cloud App Analytics (identifying which cloud apps are in use in your organization)." This directly supports using Page Events to identify accessed applications.

Application Events Section: "An application event is generated when a user performs an activity in a cloud app that Netskope can inspect via an API connection or because it is being proxied. For example

when a user logs into an app

or shares

uploads

or downloads a file." This confirms Application Events track user access through specific activities.

Network Events Section: "A network event is generated when traffic is steered to the Netskope cloud

but is not decrypted or parsed for application or web content." This confirms its unsuitability for application-specific reporting.

When creating a custom malware detection profile in Netskope, the primary method of customization beyond selecting detection engines is to add organization-specific intelligence. This is accomplished by using custom file hash lists. A blocklist (also known as a blacklist) contains hashes of files known to be malicious, ensuring they are always blocked. An allowlist (or whitelist) contains hashes of known-good files, such as proprietary internal applications, to prevent false positives. Both are distinct and fundamental components that can be added to a malware detection profile to tailor its detection logic, making them key requirements for this task.

B. Add a quarantine profile.

A quarantine profile is only required if you choose "Quarantine" as a response action. A custom detection profile can be created to use other actions like "Alert" or "Block," which do not require it.

C. Add a remediation profile.

"Remediation profile" is not a standard, configurable object within the Netskope Threat Protection module. Remediation actions (like block, quarantine, alert) are configured directly within the policy or detection profile.

1. Netskope Official Documentation

"Threat Protection": In the Netskope UI and corresponding help documentation

the configuration for a new Malware Detection Profile is located under Policies > Threat Protection > Malware Detection. The creation wizard explicitly provides separate sections to add "Allowlist" and "Blocklist" file hash lists. This demonstrates that both are distinct

expected components for customizing a profile.

2. Netskope Official Documentation

"Create a Malware Detection Profile": The documentation outlines the steps for creating a profile. It specifies that under the "File Hashes" section

an administrator can select pre-configured hash lists for both the Allowlist and Blocklist. This confirms that preparing these lists is a key part of the customization process. The documentation also shows that selecting a "Quarantine Profile" is an optional "On-Detection" action

not a mandatory requirement for creating the profile itself.

The question requires identifying three native access controls within the Netskope platform for securing privileged user access, without needing third-party integration.

1. IP allowlisting (A) is a native feature allowing administrators to restrict access to the Netskope management UI to a specific set of source IP addresses.

2. Login attempts (B) configuration is part of the native password policy settings, which can lock an administrator's account after a specified number of failed login attempts.

3. Applying roles (C), or Role-Based Access Control (RBAC), is a core, native function that limits an administrator's permissions to only what is necessary for their job, following the principle of least privilege.

These three controls are configured directly within the Netskope tenant's settings.

D. Multi-factor authentication to verify a user's authenticity.

This typically requires integration with an external SAML 2.0 Identity Provider (IdP) like Okta or Azure AD, which violates the "no external or third-party integration" constraint.

E. History-based access control based on past security actions.

This is not a standard, named feature within Netskope for controlling administrative access to the tenant UI. Access controls are primarily role-based, not dynamically history-based for administrators.

1. Netskope Official Documentation

"Role-Based Access Control (RBAC)": This document details the built-in roles (e.g.

Tenant Admin

Read Only Admin

Policy Admin) and the process for creating custom roles. It states

"Netskope provides role-based access control (RBAC) to the Netskope UI. You can assign roles to admin users that have a set of privileges." This supports option C.

2. Netskope Official Documentation

"Configure Security Settings": This section outlines several native security configurations.

Under the "Password Policy" subsection

it describes the ability to "Lockout admin after [N] failed login attempts

" which directly supports option B.

Under the "Allowed IP Addresses" subsection

it explains how to "Add an IP address

range

or subnet to the allowlist for UI and REST API access

" which directly supports option A.

3. Netskope Official Documentation

"Configure SSO for Admin Login": This guide explains that enabling SSO and MFA for administrators involves configuring a SAML 2.0 integration with an external Identity Provider. This confirms that option D requires an external integration

making it an incorrect choice based on the question's constraints.

The Netskope Client first attempts to form a secure DTLS tunnel to the nearest NewEdge/EPoP over UDP 443. If the corporate firewall filters or blocks outbound UDP 443 (and the matching return traffic), the DTLS handshake never completes and the client remains in the “Connecting” state, so no tunnel is established. Other factors (SSL interception, DNS resolution, EPoP FQDN reachability) do not prevent the client from at least negotiating a fallback TCP/443 control channel; only loss of UDP 443 definitively stops tunnel creation in an on-premise pilot deployment.

A. SSL/TLS interception changes certificates but does not block the DTLS UDP channel; the client continues over its own tunnel and will still connect.

C. Blocking a single EPoT IP would merely steer the client to another available NewEdge address; tunnel creation usually succeeds.

D. The client uses system DNS; EDNS to dns.google is not a prerequisite, so lack of it does not stop tunnel setup.

1. Netskope

“Ports and Protocols Guide

” Rev 2023-07

§3.1 “Client Traffic—DTLS

” p.4: “Client establishes DTLS tunnel over UDP 443; port must be permitted.”

2. Netskope

“Client Connection Troubleshooting

” TechNote v3.5

§2.2 “Fails to Establish Tunnel

” p.6: “Most frequent cause is corporate firewall blocking UDP 443 outbound/inbound.”

3. Netskope

“NewEdge Architecture White-Paper

” v2.1

§4 “Transport Selection

” p.9-10: “Primary transport is DTLS/UDP 443; no fallback if port is filtered.”

For a large-scale deployment with 30,000 hosts per location, capacity planning and high availability are critical for success. The number of hosts (D) is a primary factor in determining the required bandwidth for the IPsec tunnel and ensuring the selected Netskope Points of Presence (POPs) can handle the traffic volume. To maintain a resilient and continuous connection, it is a standard best practice to configure tunnels to redundant POPs (C). This involves setting up a primary tunnel to one POP and a secondary (failover) tunnel to another, ensuring service continuity if the primary POP becomes unavailable.

A. browsers in use: IPsec operates at the network layer (Layer 3). The tunnel forwards traffic from the network gateway, making the specific browser on an endpoint irrelevant to the tunnel's establishment.

B. operating systems: The IPsec tunnel is configured between a network device (e.g., firewall) and Netskope, not the individual hosts. Therefore, the operating system on the endpoints is not a consideration.

1. Netskope Official Documentation

"IPsec Configuration Guide": In the section on "High Availability

" the guide explicitly recommends configuring tunnels to both a primary and a secondary POP for failover and redundancy. This directly supports option C.

2. Netskope Official Documentation

"Netskope NewEdge": The documentation on the NewEdge architecture and deployment planning emphasizes sizing considerations. The section on "Bandwidth and Sizing" states that the number of users (hosts) is a key metric for calculating the required bandwidth and selecting appropriate POPs to ensure performance. This directly supports option D.

3. Netskope Official Documentation

"Secure Web Gateway Deployment Guide": In the chapter covering traffic steering methods

the IPsec section highlights that planning must account for the total number of users and their expected traffic load to prevent performance bottlenecks. This reinforces the importance of considering the number of hosts (D).

Integrating Netskope with an Endpoint Detection and Response (EDR) solution like Crowdstrike is accomplished through Netskope's Cloud Threat Exchange (CTE). A successful integration for sharing threat data requires two key components:

1. API Credentials: To establish a secure, authenticated connection between the Netskope platform and the EDR vendor's cloud platform, API credentials are required. For Crowdstrike, this specifically involves generating a Client ID and a Client Secret from the Crowdstrike Falcon console.

2. Action/Remediation Configuration: To make the threat sharing functional, you must define what action the EDR should take when it receives threat intelligence from Netskope. This is configured in Netskope as an action or remediation profile, which specifies responses like "Quarantine Host" or "Block Hash."

B. Device classification: This feature categorizes endpoints (e.g., managed/unmanaged) for policy enforcement, but it is not a direct technical requirement for establishing the API-based threat-sharing integration itself.

D. Custom log parser: This is used for Netskope's Cloud Log Ingestion (CLS) to parse logs from unsupported applications. EDR integration uses pre-built API connectors via Cloud Threat Exchange, not log parsing.

1. Netskope Official Documentation

"Configure CrowdStrike Falcon Plugin for CTE": This guide explicitly lists the prerequisites for the integration. Under the "Prerequisites" section

it states: "To configure the CrowdStrike Falcon plugin

you need the Client ID and Client Secret from your CrowdStrike Falcon account." This directly supports the requirement for an API Client ID (C).

2. Netskope Official Documentation

"Cloud Threat Exchange": This document describes the workflow for CTE. It explains that after configuring a plugin

you must "Create business rules to share threat intelligence... When a rule is triggered

CTE performs the action defined in the rule." The configuration of these actions (e.g.

quarantine host) is functionally a Remediation Profile (A) that dictates the response of the integrated EDR system. The "Configure a Business Rule" section in the Crowdstrike plugin guide shows the step where an "Action" must be selected.