RSA 050-11-CARSANWLN01 Exam Questions Instant Access

Question 1

You configure an email server for notifications for everything except the Reporting Engine in:

AADMIN > System > Global Auditing

BADMIN > System > Legacy Notifications

CADMIN > System > Email

DADMIN > System > Global Notifications

Answer : C

Question 2

When adding a data source to the ESA device. RSA recommends using only the

AConcentrator

BDecoder

CLog Collector

DArchiver

Answer : A

Question 3

To enable reporting alerts to be sent to the Respond interface, you would

Aset up an output action in the Report Engine configuration

Bchange the capture interface in Reporting sources

Cconfigure forwarding of alerts in the Reporting Engine configuration

Dset up an output action in a Report

Answer : C

Question 4

The Context Hub runs as a service on which Host?

ADecoder

BConcentrator

CESA

DServer

Answer : C

Question 5

What types of data can the Archiver store?

ARaw Log only

BRaw Log and Log Meta

CRaw Log, Log Meta. Packet Meta

DRaw Log. Log Meta. Raw Packet. Packet Meta

Answer : D

Question 6

What is the definition of an RSA NetWitness ad hoc feed?

AA feed that is deployed one time on one or more Decoders

BA feed that is deployed once on three or more Decoders

CA feed that is deployed on no more than three Decoders once

DA feed that is deployed on one or more Decoders at least three times

Answer : A

Question 7

What happens when you set the metadata associated with a parser to Transients

ATransient means the Decoder is using the parser to parse traffic, and the generated metadata is not stored on disk

BTransient means the Decoder is using the parser to parse traffic, and the generated metadata is retained on disk for 24 hours

CTransient means the Decoder is using the parser only to filter out data, not to generate metadata

DTransient means the Decoder is using the parser only for ESA

Answer : C

RSA NetWitness Logs & Network Administrator 050-11-CARSANWLN01 Exam Questions