RSA 050-11-CARSANWLN01 Exam Questions Instant Access

Question 1

Application rules can be configured on

ALog Decoder

BLog Decoder and Packet Decoder

CLog Decoder, Packet Decoder, and Concentrator

DLog Decoder, Packet Decoder, Concentrator, and Broker

Answer : B

Question 2

Which step happens first in the RSA NetWitness data flow on the Packet Decoder when the capture interface is set to packet_mmap_"?

AFeeds evaluated

BNetwork rules evaluated

CApplication rules evaluated

DBerkeley Packet Filter evaluated

Answer : D

Question 3

Which of the following statements is true regarding Packet-based analysis in general?

APacket-based analysis is required for viewing log and session data

BPacket-based analysis is based on metadata capture reduced to packets

CPacket-based analysis can be accomplished with common tools such as Wireshark

DPacket-based analysis is accomplished using the table-map xml file

Answer : B

Question 4

To customize your query display in Events View, create

ACustom Meta Groups

BCustom Column Groups

CProfiles

DDashlets

Answer : B

Question 5

To automate incident creation of alerts in the Respond interface, create

AESA Rules

BRespond Rules

CIncident Rules

DReporting Rules

Answer : C

Question 6

When adding a data source to the ESA device. RSA recommends using only the

AConcentrator

BDecoder

CLog Collector

DArchiver

Answer : A

Question 7

What are the two basic operations you might perform to make use of a Live resource?

Amove and copy

Bdownload and enable

Csave and apply

Dsubscribe and deploy

Answer : D

RSA NetWitness Logs & Network Administrator 050-11-CARSANWLN01 Exam Questions