RSA 050-11-CARSANWLN01 Exam Practice Test Instant Access

Question 1

Which device index file should you use to create new meta keys?

Aindex-user, xml

Bindex-default xml

Cindex-<device> xml

Dindex-<device>-custom xml

Answer : D

Question 2

Under the NetWitness Trust Model, in order to log in to multiple services a user need only have an account on which device?

AConcentrator.

BPacket Decoder

CNetWitness Server

DWindows Domain Controller

Answer : C

Question 3

What are the data sources available in RSA NetWitness when creating a Reporting Engine rule?

AShort, Long, Truncated

BIPDB, ODBC, FileReader

CBroker, Concentrator, Decoder

DNetWitness DB, Warehouse DB, Respond DB

Answer : D

Question 4

Parsers can be enabled on which of the following?

APacket Decoder only

BPacket Decoder and Log Decoder

CPacket Decoder and Log Decoder and Concentrator

DPacket Decoder and Log Decoder and Concentrator and Broker

Answer : B

Question 5

What are the two basic operations you might perform to make use of a Live resource?

Amove and copy

Bdownload and enable

Csave and apply

Dsubscribe and deploy

Answer : D

Question 6

When storage on the core devices fills to capacity, what happens?

Anew traffic cannot be ingested

Bthe decoder leverages capacity in the concentrator, and collection continues

Cthe decoder leverages capacity in the broker, and collection continues

Dthe oldest stored sessions are deleted and collection continues

Answer : D

Question 7

The NetWitness Trust Model is based on

AUser ID

BUser Role

CIP address

DHardware address

Answer : B

RSA 050-11-CARSANWLN01 RSA NetWitness Logs & Network Administrator Exam Practice Test