RSA NetWitness Logs & Network Administrator Exam (050-11-CARSANWLN01) Practice Test

Questions # 11:

When NetWitness receives a log from an event source that does not currently exist in the Admin. Event Sources list, what does it do?

Options:

Writes the log to the Archiver but not the Decoder

Parses the log to the Decoder, but in transient mode only

Adds the new Event Source to the existing list of Event Sources

Ignores the log altogether

Questions # 12:

To create a custom feed, initiate the action by selecting which top-level module?

Options:

Investigate

Admin

Monitor

Configure

Questions # 13:

Which step happens first in the RSA NetWitness data flow on the Packet Decoder when the capture interface is set to packet_mmap_"?

Options:

Feeds evaluated

Network rules evaluated

Application rules evaluated

Berkeley Packet Filter evaluated

Questions # 14:

Where do you define dynamic charts for real-time display in Dashboards?

Options:

Default Dashboard

MONITOR > Reports > Manage > Charts

MONITOR > Reports > Charts > View

CONFIGURE > ESA Rules

Questions # 15:

Which of the following actions can a Network Rule NOT perform?

Options:

Filter

Truncate

Alert

Forward

Questions # 16:

Which of the following rule types relies on two or more events occurring within a specified window of time?

Options:

Network Rule

Application Rule

Correlation Rule

BPF Filter Rule

Questions # 17:

What are the pre-configured roles in RSA NetWitness?

Options:

EVENT_ANALYST, INTRUSION_ANALYST SOC-MANAGER, ADMIN, OPERATOR, RESPOND_ADMINlSTRATOR

EVENT_STREAM_ANALYST WAREHOUSE_ANALYST, ARCHIVER_ANALYST, DB_ANALYST ADMINISTRATOR

MALWARE_ANALYST, ESA_ANALYST, REPORT_ANALYST ADMINISTRATOR

ADMINISTRATORS, OPERATORS, ANALYSTS SOC_MANAGERS, MALWARE_ANALYSTS, DATA_PRIVACY_OFFICERS, RESPOND ADMINISTRATOR

Questions # 18:

To prevent a Meta key from being indexed on a core service, you can

Options:

disable the parser for the Meta key in the device configuration

add the value /eve/= indexNone to the key in the custom index file

remove the Meta key from the Manage Default Meta Keys interface

add the value valueMax= ‘’000000’’ to the key in the custom index file

Questions # 19:

To enable reporting alerts to be sent to the Respond interface, you would

Options:

set up an output action in the Report Engine configuration

change the capture interface in Reporting sources

configure forwarding of alerts in the Reporting Engine configuration

set up an output action in a Report

Questions # 20:

You configure an email server for notifications for everything except the Reporting Engine in:

Options:

ADMIN > System > Global Auditing

ADMIN > System > Legacy Notifications

ADMIN > System > Email

ADMIN > System > Global Notifications

Viewing page 2 out of 3 pages

Viewing questions 11-20 out of questions

Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Pass the RSA NetWitness Platform 050-11-CARSANWLN01 Questions and answers with ExamsMirror

Exam 050-11-CARSANWLN01 Premium Access

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options:

TOP CODES