RSA 050-11-CARSANWLN01 Exam Questions Instant Access

Question 1

The RSA NetWitness Reporting Engine provides visibility into captured data via which of the following mechanisms?

Astatic and/or dynamic analysis

Balerts, reports and charts

Ccommunity and/or sandbox analysis

Dad hoc, schedules, and/or auto-run features

Answer : C

Question 2

Which of the following can NOT be configured as a data source for the Reporting Engine?

ABroker

BConcentrator

CArchiver

DESA

Answer : D

Question 3

Which of the following statements about the REST interface are true? (Choose two)

AThe REST interface is available only for Concentrators and Decoders

BThe REST interface is available separately for each core Service on the Host

CThe REST interface for the Broker service defaults to 50103

DThe REST interface for the Concentrator service defaults to 51005

EThe REST interface for the Decoder service defaults to 50014

Answer : B, C

Question 4

To add an action to the right-click menu in the Investigation Ul. create a

ARight-click action

BProfile

CContext Hub List

DContext Menu Action

Answer : D

Question 5

To automate incident creation of alerts in the Respond interface, create

AESA Rules

BRespond Rules

CIncident Rules

DReporting Rules

Answer : C

Question 6

To run a report you need to create which of the following?

AView

BAlert

CReport rule

DSchedule

Answer : C

Question 7

Which of the following statements is true regarding Packet-based analysis in general?

APacket-based analysis is required for viewing log and session data

BPacket-based analysis is based on metadata capture reduced to packets

CPacket-based analysis can be accomplished with common tools such as Wireshark

DPacket-based analysis is accomplished using the table-map xml file

Answer : B

RSA NetWitness Logs & Network Administrator 050-11-CARSANWLN01 Exam Questions