050-11-CARSANWLN01試験無料問題集（72題）「RSA NetWitness Logs & Network Administrator 認定」

出題：1

If you choose "Stop Rule Processing" in your Application Rule definition, which of the following are action choices? (Choose three)

A. Truncate

B. Keep

C. Remove

D. Index

E. Filter

F. Transient

正解：A,B,E 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：2

When NetWitness receives a log from an event source that does not currently exist in the Admin. Event Sources list, what does it do?

A. Parses the log to the Decoder, but in transient mode only

B. Ignores the log altogether

C. Writes the log to the Archiver but not the Decoder

D. Adds the new Event Source to the existing list of Event Sources

正解：D 解答を投票する

出題：3

You configure an email server for notifications for everything except the Reporting Engine in:

A. ADMIN > System > Global Auditing

B. ADMIN > System > Legacy Notifications

C. ADMIN > System > Email

D. ADMIN > System > Global Notifications

正解：C 解答を投票する

出題：4

Administrators can use the Profile feature to limit views with (Choose three)

A. Data privacy policies

B. Assigned pre-queries

C. Meta groups

D. List view

E. Automated role assignment

F. Custom column groups

正解：B,C,F 解答を投票する

出題：5

Logging in to NetWitness via RAM requires which of the following to succeed'?

A. Kerberos Authentication

B. PAM User Authentication

C. NSS Group Authentication

D. PAM User Authentication and Group Mapping

正解：B 解答を投票する

出題：6

What is the main purpose of creating a meta group?

A. Isolate log data

B. Increase the amount of data available for analysis

C. Eliminate unneeded keys

D. Perform Visualization analysis

正解：C 解答を投票する

出題：7

Which RSA NetWitness component captures and parses data off the wire?

A. Packet Decoder

B. Broker

C. Concentrator

D. Log Decoder

正解：A 解答を投票する

050-11-CARSANWLN01試験無料問題集「RSA NetWitness Logs & Network Administrator 認定」