RSA 050-11-CARSANWLN01 Exam Questions Instant Access

Question 1

Which of the following rule types relies on two or more events occurring within a specified window of time?

ANetwork Rule

BApplication Rule

CCorrelation Rule

DBPF Filter Rule

Answer : C

Question 2

When storage on the core devices fills to capacity, what happens?

Anew traffic cannot be ingested

Bthe decoder leverages capacity in the concentrator, and collection continues

Cthe decoder leverages capacity in the broker, and collection continues

Dthe oldest stored sessions are deleted and collection continues

Answer : D

Question 3

Which of the following statements best defines an RSA NetWitness application rule?

AThe rule filters, truncates, keeps or otherwise flags data analyzed by RSA NetWitness

BThe rule is used primarily to distribute content among RSA NetWitness appliances

CThe rule uses external intelligence based on IP addresses or domains to add contextual content to network traffic

DThe rule is an open programming language for customizing logic into the RSA NetWitness processing engine to identify new protocols or extract data to be indexed

Answer : A

Question 4

Which output actions are available when creating Reporting Engine alerts'?

AOSX, ODBC, Syslog

BODBC, SQL, Syslog, SMTP, URL, NetworkShare

CSNMP, SMTP, Syslog, SFTP, URL, NetworkShare

DSNMP, ODBC, Syslog, FTP

Answer : C

Question 5

Where is the PAM configuration file located on an RSA NetWitness appliance'?

A/etc/hosts

B/etc/pam.d

C/opVbin/pam

D/usr/birVconfig

Answer : B

Question 6

Which of the following statements is true regarding Packet-based analysis in general?

APacket-based analysis is required for viewing log and session data

BPacket-based analysis is based on metadata capture reduced to packets

CPacket-based analysis can be accomplished with common tools such as Wireshark

DPacket-based analysis is accomplished using the table-map xml file

Answer : B

Question 7

What of the following components can be used to set up external authentication for RSA NetWitness?

AAAoP

BBroker

CSpectrum

DPAM

Answer : D

RSA NetWitness Logs & Network Administrator 050-11-CARSANWLN01 Exam Questions