050-11-CARSANWLN01 無料問題集「RSA NetWitness Logs & Network Administrator」

（A）BPF Filter Rule

（B）Correlation Rule

（C）Network Rule

（D）Application Rule

（A）Network rules evaluated

（B）Feeds evaluated

（C）Berkeley Packet Filter evaluated

（D）Application rules evaluated

（A）Custom Column Groups

（B）Custom Meta Groups

（C）Dashlets

（D）Profiles

（A）/opVbin/pam

（B）/usr/birVconfig

（C）/etc/pam.d

（D）/etc/hosts

（A）The rule is used primarily to distribute content among RSA NetWitness appliances

（B）The rule filters, truncates, keeps or otherwise flags data analyzed by RSA NetWitness

（C）The rule uses external intelligence based on IP addresses or domains to add contextual content to network traffic

（D）The rule is an open programming language for customizing logic into the RSA NetWitness processing engine to identify new protocols or extract data to be indexed

（A）remove the Meta key from the Manage Default Meta Keys interface

（B）add the value /eve/= indexNone to the key in the custom index file

（C）disable the parser for the Meta key in the device configuration

（D）add the value valueMax= ''000000'' to the key in the custom index file

（A）A List

（B）A Subscription

（C）An Application Rule

（D）An Enrichment Source