RSA 050-11-CARSANWLN01 Quiz 3 Topic 3 Questions 11-15

Question: 1

What happens when you set the metadata associated with a parser to Transients

ATransient means the Decoder is using the parser to parse traffic, and the generated metadata is not stored on disk

BTransient means the Decoder is using the parser to parse traffic, and the generated metadata is retained on disk for 24 hours

CTransient means the Decoder is using the parser only to filter out data, not to generate metadata

DTransient means the Decoder is using the parser only for ESA

Show Answer

Question: 2

Which of the following is the basic building block of a report in RSA NetWitness?

ARule

BBroker

CPacket

DSession

Show Answer

Question: 3

The logical operators available for Querying in Investigations depend on the Index Level of the individual meta key Which Index Level limits your query to the logical operators "exists'' and 'texists""?

AIndexNone

BIndexKeys

CIndexValues

DIndexAII

Show Answer

Question: 4

In what order are filters evaluated as data flows through the Decoder'?

AFeeds. Network Rules. LUA Parsers. Application Rules. BPF

BFeeds. Network Rules. BPF. Application Rules, LUA Parsers

CNetwork Rules. Feeds. Application Rules. BPF, LUA Parsers

DBPF. Network Rules. LUA Parsers. Feeds. Application Rules

Show Answer

Question: 5

To create a custom feed, initiate the action by selecting which top-level module'?

AInvestigate

BAdmin

CMonitor

DConfigure

Show Answer

RSA 050-11-CARSANWLN01 Quiz:3 Topic:3 Questions:11-15