RSA 050-11-CARSANWLN01 Exam Practice Test Instant Access

Question 1

Which of the following can NOT be configured as a data source for the Reporting Engine?

ABroker

BConcentrator

CArchiver

DESA

Answer : D

Question 2

Which of the following statements is true regarding Packet-based analysis in general?

APacket-based analysis is required for viewing log and session data

BPacket-based analysis is based on metadata capture reduced to packets

CPacket-based analysis can be accomplished with common tools such as Wireshark

DPacket-based analysis is accomplished using the table-map xml file

Answer : B

Question 3

To add an action to the right-click menu in the Investigation Ul. create a

ARight-click action

BProfile

CContext Hub List

DContext Menu Action

Answer : D

Question 4

To automate incident creation of alerts in the Respond interface, create

AESA Rules

BRespond Rules

CIncident Rules

DReporting Rules

Answer : C

Question 5

Which of the following choices is defined as being a delineated set of network data units that comprise a transaction from start to finish'?

AFrame

BPacket

CSession

DToken

Answer : C

Question 6

When storage on the core devices fills to capacity, what happens?

Anew traffic cannot be ingested

Bthe decoder leverages capacity in the concentrator, and collection continues

Cthe decoder leverages capacity in the broker, and collection continues

Dthe oldest stored sessions are deleted and collection continues

Answer : D

Question 7

Under the NetWitness Trust Model, in order to log in to multiple services a user need only have an account on which device?

AConcentrator.

BPacket Decoder

CNetWitness Server

DWindows Domain Controller

Answer : C

RSA 050-11-CARSANWLN01 RSA NetWitness Logs & Network Administrator Exam Practice Test