← Back to exam page

050-11-CARSANWLN01 – RSA NetWitness Logs & Network Administrator Exam

Loading demo links...

Showing 7–9 of 10 questions

Question 7

When NetWitness receives a log from an event source that does not currently exist in the Admin. Event Sources list, what does it do?

Select an option, then click Submit answer.

  • ○

    Writes the log to the Archiver but not the Decoder
  • ○

    Parses the log to the Decoder, but in transient mode only
  • ○

    Adds the new Event Source to the existing list of Event Sources
  • ○

    Ignores the log altogether
Question 8

When storage on the core devices fills to capacity, what happens?

Select an option, then click Submit answer.

  • ○

    new traffic cannot be ingested
  • ○

    the decoder leverages capacity in the concentrator, and collection continues
  • ○

    the decoder leverages capacity in the broker, and collection continues
  • ○

    the oldest stored sessions are deleted and collection continues
Question 9

To use RSA SecurlD as an authentication method for administrators, what must be configured?

Select an option, then click Submit answer.

  • ○

    PAM
  • ○

    CHAP
  • ○

    RADIUS
  • ○

    LDAP