RSA 050-11-CARSANWLN01 Exam Practice Test Instant Access

Question 1

To automate incident creation of alerts in the Respond interface, create

AESA Rules

BRespond Rules

CIncident Rules

DReporting Rules

Answer : C

Question 2

In what order are filters evaluated as data flows through the Decoder?

AFeeds. Network Rules. LUA Parsers. Application Rules. BPF

BFeeds. Network Rules. BPF. Application Rules, LUA Parsers

CNetwork Rules. Feeds. Application Rules. BPF, LUA Parsers

DBPF. Network Rules. LUA Parsers. Feeds. Application Rules

Answer : D

Question 3

Logging in to NetWitness via RAM requires which of the following to succeed'?

APAM User Authentication

BNSS Group Authentication

CPAM User Authentication and Group Mapping

DKerberos Authentication

Answer : A

Question 4

The RSA NetWitness Reporting Engine provides visibility into captured data via which of the following mechanisms?

Astatic and/or dynamic analysis

Balerts, reports and charts

Ccommunity and/or sandbox analysis

Dad hoc, schedules, and/or auto-run features

Answer : C

Question 5

Which CLI command would have the effect of starting the Ul Web Server in NetWitness 11?

Astart ---s nwappliance

Bsystemctl start saserver service

Csystemctl start jetty service

Dsystemctl start -s saserver

Answer : C

Question 6

What are the two basic operations you might perform to make use of a Live resource?

Amove and copy

Bdownload and enable

Csave and apply

Dsubscribe and deploy

Answer : D

Question 7

Which of the following statements about the REST interface are true? (Choose two)

AThe REST interface is available only for Concentrators and Decoders

BThe REST interface is available separately for each core Service on the Host

CThe REST interface for the Broker service defaults to 50103

DThe REST interface for the Concentrator service defaults to 51005

EThe REST interface for the Decoder service defaults to 50014

Answer : B, C

RSA NetWitness Logs & Network Administrator 050-11-CARSANWLN01 Exam Practice Test