050-11-CARSANWLN01 Online Training Archives

Exam4Training is the only website which is able to supply all your needed information about 050-11-CARSANWLN01 RSA NetWitness Logs & Network Administrator Exam exam. Using RSA 050-11-CARSANWLN01 RSA NetWitness Logs & Network Administrator Exam Online Training provided by Exam4Training to pass RSA 050-11-CARSANWLN01 exam is not a problem, and you can pass the RSA NetWitness 050-11-CARSANWLN01 exam with high scores.If you want to buy RSA 050-11-CARSANWLN01 RSA NetWitness Logs & Network Administrator Exam Online Training, then we Exam4Training is one of the leading service provider’s site.

Page 1 of 2

1. To report on matches in the NWDB against a series of fixed values, include which feature in your report definition?

An Application Rule

A List

An Enrichment Source

A Subscription

2. To create a custom feed, initiate the action by selecting which top-level module?

Investigate

Admin

Monitor

Configure

3. Which of the following choices is defined as being a delineated set of network data units that comprise a transaction from start to finish'?

Frame

Packet

Session

Token

4. In RSA NetWitness. viewing text or image data associated with a session is accessed through a

packet level drill

meta value view

session reconstruction view

decoder analysis view

5. When storage on the core devices fills to capacity, what happens?

new traffic cannot be ingested

the decoder leverages capacity in the concentrator, and collection continues

the decoder leverages capacity in the broker, and collection continues

the oldest stored sessions are deleted and collection continues

6. Administrators can use the Profile feature to limit views with (Choose three)

Meta groups

Custom column groups

Assigned pre-queries

Automated role assignment

Data privacy policies

List view

7. To customize your query display in Events View, create

Custom Meta Groups

Custom Column Groups

Profiles

Dashlets

8. You can configure replication for log data by setting up a remote collector and creating

a Virtual Log Collector

a lockbox

host groups

destination groups

9. What types of data can the Archiver store?

Raw Log only

Raw Log and Log Meta

Raw Log, Log Meta. Packet Meta

Raw Log. Log Meta. Raw Packet. Packet Meta

10. Which RSA NetWitness component captures and parses data off the wire?

Packet Decoder

Broker

Concentrator

Log Decoder

Page 2 of 2

11. To add an action to the right-click menu in the Investigation Ul. create a

Right-click action

Profile

Context Hub List

Context Menu Action

12. Parsers can be enabled on which of the following?

Packet Decoder only

Packet Decoder and Log Decoder

Packet Decoder and Log Decoder and Concentrator

Packet Decoder and Log Decoder and Concentrator and Broker

13. Which of the following choices describes a fundamental unit of network traffic transmitted from one IP device to another?

Packet

Chart

Session

Schedule

14. What are the data sources available in RSA NetWitness when creating a Reporting Engine rule?

Short, Long, Truncated

IPDB, ODBC, FileReader

Broker, Concentrator, Decoder

NetWitness DB, Warehouse DB, Respond DB

15. Which of the following rule types relies on two or more events occurring within a specified window of time?

Network Rule

Application Rule

Correlation Rule

BPF Filter Rule

16. What are the two basic operations you might perform to make use of a Live resource?

move and copy

download and enable

save and apply

subscribe and deploy

17. Service Groups are used primarily for

grouping metadata from specified hosts

deploying Live resources to specified services

grouping hosts for batch configuration

grouping hosts for monitoring performance in the Health and Wellness view

18. The NetWitness Trust Model is based on

User ID

User Role

IP address

Hardware address

19. What are three important things to configure on a Log Decoder'?

Capture Auto-Start. Service Parsers, Capture Interface

Capture Settings. Aggregation Auto-Start. Profile settings

Investigation Settings. Capture Settings. Service Parsers

Aggregation Auto-Start. Capture Settings. Investigation Settings

20. Where do you define dynamic charts for real-time display in Dashboards?

Default Dashboard

MONITOR > Reports > Manage > Charts

MONITOR > Reports > Charts > View

CONFIGURE > ESA Rules