RSA 050-11-CARSANWLN01 Exam Practice Test Instant Access

Question 1

You configure an email server for notifications for everything except the Reporting Engine in:

AADMIN > System > Global Auditing

BADMIN > System > Legacy Notifications

CADMIN > System > Email

DADMIN > System > Global Notifications

Answer : C

Question 2

When NetWitness receives a log from an event source that does not currently exist in the Admin. Event Sources list, what does it do?

AWrites the log to the Archiver but not the Decoder

BParses the log to the Decoder, but in transient mode only

CAdds the new Event Source to the existing list of Event Sources

DIgnores the log altogether

Answer : C

Question 3

Parsers can be enabled on which of the following?

APacket Decoder only

BPacket Decoder and Log Decoder

CPacket Decoder and Log Decoder and Concentrator

DPacket Decoder and Log Decoder and Concentrator and Broker

Answer : B

Question 4

Which of the following is the basic building block of a report in RSA NetWitness?

ARule

BBroker

CPacket

DSession

Answer : A

Question 5

Where do you define dynamic charts for real-time display in Dashboards?

ADefault Dashboard

BMONITOR > Reports > Manage > Charts

CMONITOR > Reports > Charts > View

DCONFIGURE > ESA Rules

Answer : B

Question 6

Which of the following statements is true regarding Packet-based analysis in general?

APacket-based analysis is required for viewing log and session data

BPacket-based analysis is based on metadata capture reduced to packets

CPacket-based analysis can be accomplished with common tools such as Wireshark

DPacket-based analysis is accomplished using the table-map xml file

Answer : B

Question 7

The logical operators available for Querying in Investigations depend on the Index Level of the individual meta key Which Index Level limits your query to the logical operators "exists'' and 'texists""?

AIndexNone

BIndexKeys

CIndexValues

DIndexAII

Answer : B

RSA 050-11-CARSANWLN01 RSA NetWitness Logs & Network Administrator Exam Practice Test