050-11-CARSANWLN01 Practice Questions

A.  

new traffic cannot be ingested

B.  

the decoder leverages capacity in the concentrator, and collection continues

C.  

the decoder leverages capacity in the broker, and collection continues

D.  

the oldest stored sessions are deleted and collection continues

A.  

Deploying content to the context hub

B.  

Deploying a resource bundle

C.  

Subscribing to a resource

D.  

Deploying content to air gapped networks

A.  

Investigate

B.  

Admin

C.  

Monitor

D.  

Configure

A.  

EVENT_ANALYST, INTRUSION_ANALYST SOC-MANAGER, ADMIN, OPERATOR, RESPOND_ADMINlSTRATOR

B.  

EVENT_STREAM_ANALYST WAREHOUSE_ANALYST, ARCHIVER_ANALYST, DB_ANALYST ADMINISTRATOR

C.  

MALWARE_ANALYST, ESA_ANALYST, REPORT_ANALYST ADMINISTRATOR

D.  

ADMINISTRATORS, OPERATORS, ANALYSTS SOC_MANAGERS, MALWARE_ANALYSTS, DATA_PRIVACY_OFFICERS, RESPOND ADMINISTRATOR

A.  

assigned the role of Operator"

B.  

a member of a "DeviceUser" group in Active Directory

C.  

a member of a role that has privileges for the device

D.  

assigned read/write access to the NetWitness appliance

A.  

Packet Decoder

B.  

Broker

C.  

Concentrator

D.  

Log Decoder

A.  

A feed that is deployed one time on one or more Decoders

B.  

A feed that is deployed once on three or more Decoders

C.  

A feed that is deployed on no more than three Decoders once

D.  

A feed that is deployed on one or more Decoders at least three times

A.  

index xml and index.orig.xml

B.  

index-rsa.txt and index-custom txt

C.  

index-rsa.xml and index-custom xml

D.  

index- xml and index--custom xml

A.  

Writes the log to the Archiver but not the Decoder

B.  

Parses the log to the Decoder, but in transient mode only

C.  

Adds the new Event Source to the existing list of Event Sources

D.  

Ignores the log altogether

A.  

Suppression schedules can be defined for individual rules

B.  

Suppression schedules can be defined for entire policies

C.  

Suppression schedules can be applied to out-of-the-box policies

D.  

Multiple suppression schedules can be defined