When NetWitness receives a log from an event source that does not currently exist in the Admin. Event Sources list, what does it do?

AWrites the log to the Archiver but not the Decoder

BParses the log to the Decoder, but in transient mode only

CAdds the new Event Source to the existing list of Event Sources

DIgnores the log altogether

Answer : C

To create a feed for all of your event sources, you could:

ADeploy a feed from Live

BExport event source data from the Manage Events Sources interface and create a custom feed

CCreate a log parser

DExport event source data from the Manage Events Sources interface and create an identity feed

Answer : B

Which of the following are valid sources for the Context Hub? (Choose two)

ARSA Endpoint

BRespond Server

CHealth and Wellness module

DWeb Threat Detection

EReporting Engine

Answer : A, B

RSA NetWitness services implement what type of access control?

ARole-based

BDigital Certificate-based

CAccess Control List (ACL)

DDiscretionary Access Control (DAC)

Answer : A

Which of the following is a valid data source for Respond Alerts?

ALive Feeds

BApplication Rules

CNetwork Rules

DReporting Engine

Answer : D

Free Practice Questions for RSA 050-11-CARSANWLN01 Exam