050-11-CARSANWLN01 無料問題集「RSA NetWitness Logs & Network Administrator」

（A）Incident Rules

（B）Who is Lookup Service

（C）Context Hub

（D）ESA Analytics Mappings

（A）Parses the log to the Decoder, but in transient mode only

（B）Ignores the log altogether

（C）Adds the new Event Source to the existing list of Event Sources

（D）Writes the log to the Archiver but not the Decoder

（A）assigned the role of Operator"

（B）assigned read/write access to the NetWitness appliance

（C）a member of a role that has privileges for the device

（D）a member of a "DeviceUser" group in Active Directory

（A）The rule is used primarily to distribute content among RSA NetWitness appliances

（B）The rule filters, truncates, keeps or otherwise flags data analyzed by RSA NetWitness

（C）The rule uses external intelligence based on IP addresses or domains to add contextual content to network traffic

（D）The rule is an open programming language for customizing logic into the RSA NetWitness processing engine to identify new protocols or extract data to be indexed

（A）DAS and NAS

（B）DAC, SAN. and NAS

（C）NAS and SAN

（D）JBOD and DAS

（A）Incident Rules

（B）Respond Rules

（C）ESA Rules

（D）Reporting Rules

（A）Suppression schedules can be defined for entire policies

（B）Suppression schedules can be defined for individual rules

（C）Suppression schedules can be applied to out-of-the-box policies

（D）Multiple suppression schedules can be defined