050-11-CARSANWLN01 Exam Questions To Pass RSA NetWitness Logs & Network Administrator Exam (71 Q&As)

1. To report on matches in the NWDB against a series of fixed values, include which feature in your report definition?

2. To create a custom feed, initiate the action by selecting which top-level module?

3. Which of the following choices is defined as being a delineated set of network data units that comprise a transaction from start to finish’?

4. In RSA NetWitness. viewing text or image data associated with a session is accessed through a

5. When storage on the core devices fills to capacity, what happens?

6. Administrators can use the Profile feature to limit views with (Choose three)

7. To customize your query display in Events View, create

8. You can configure replication for log data by setting up a remote collector and creating

9. What types of data can the Archiver store?

10. Which RSA NetWitness component captures and parses data off the wire?

11. To add an action to the right-click menu in the Investigation Ul. create a

12. Parsers can be enabled on which of the following?

13. Which of the following choices describes a fundamental unit of network traffic transmitted from one IP device to another?

14. What are the data sources available in RSA NetWitness when creating a Reporting Engine rule?

15. Which of the following rule types relies on two or more events occurring within a specified window of time?

16. What are the two basic operations you might perform to make use of a Live resource?

17. Service Groups are used primarily for

18. The NetWitness Trust Model is based on

19. What are three important things to configure on a Log Decoder’?

20. Where do you define dynamic charts for real-time display in Dashboards?