RSA 050-11-CARSANWLN01 Exam Practice Test Instant Access

Question 1

What are the data sources available in RSA NetWitness when creating a Reporting Engine rule?

AShort, Long, Truncated

BIPDB, ODBC, FileReader

CBroker, Concentrator, Decoder

DNetWitness DB, Warehouse DB, Respond DB

Answer : D

Question 2

The types of feeds that you can add to RSA NetWitness are:

APublic feed, private feed

BCustom feed. Live feed

CIdentity feed, resource feed

DCustom feed, identity feed

Answer : D

Question 3

Which storage options are available for Archiver storage?

ADAC, SAN. and NAS

BNAS and SAN

CDAS and NAS

DJBOD and DAS

Answer : A

Question 4

Which RSA NetWitness component captures and parses data off the wire?

APacket Decoder

BBroker

CConcentrator

DLog Decoder

Answer : A

Question 5

Which statement about Health and Wellness Alarm Suppression is false?

ASuppression schedules can be defined for individual rules

BSuppression schedules can be defined for entire policies

CSuppression schedules can be applied to out-of-the-box policies

DMultiple suppression schedules can be defined

Answer : B

Question 6

To enable reporting alerts to be sent to the Respond interface, you would

Aset up an output action in the Report Engine configuration

Bchange the capture interface in Reporting sources

Cconfigure forwarding of alerts in the Reporting Engine configuration

Dset up an output action in a Report

Answer : C

Question 7

To prevent a Meta key from being indexed on a core service, you can

Adisable the parser for the Meta key in the device configuration

Badd the value /eve/= indexNone to the key in the custom index file

Cremove the Meta key from the Manage Default Meta Keys interface

Dadd the value valueMax= ''000000'' to the key in the custom index file

Answer : D

RSA 050-11-CARSANWLN01 RSA NetWitness Logs & Network Administrator Exam Practice Test