Limited-Time Offer: Enjoy 50% Savings! Ends in 00h 00m 00s Coupon code: 50OFF
Skip to content

Free RSA NetWitness Logs & Network Administrator 050-11-CARSANWLN01 Exam Questions

Page: 1 / 8 Total 71 questions

Want more questions? Get Premium Access.

Question 1

The logical operators available for Querying in Investigations depend on the Index Level of the individual meta key Which Index Level limits your query to the logical operators "exists'' and 'texists""?

Correct Answer: B. IndexKeys

Question 2

Which device index file should you use to create new meta keys?

Correct Answer: D. index-<device>-custom xml

Question 3

Where is the PAM configuration file located on an RSA NetWitness appliance'?

Correct Answer: B. /etc/pam.d

Question 4

Which of the following can NOT be configured as a data source for the Reporting Engine?

Correct Answer: D. ESA

Question 5

Logging in to NetWitness via RAM requires which of the following to succeed'?

Correct Answer: A. PAM User Authentication

Question 6

Which RSA NetWitness component captures and parses data off the wire?

Correct Answer: A. Packet Decoder

Question 7

Which of the following statements about Health and Wellness Policies is false?

Correct Answer: C. Out-of-the-box policies can be edited by NW administrators

Question 8

What are three important things to configure on a Log Decoder'?

Correct Answer: A. Capture Auto-Start. Service Parsers, Capture Interface

Question 9

When NetWitness receives a log from an event source that does not currently exist in the Admin. Event Sources list, what does it do?

Correct Answer: C. Adds the new Event Source to the existing list of Event Sources

Question 10

Administrators can use the Profile feature to limit views with (Choose three)

Correct Answer: A. Meta groups; B. Custom column groups; C. Assigned pre-queries