RSA NetWitness Logs & Network Administrator - 050-11-CARSANWLN01 Exam Questions [2026]

QUESTION NO: 1
What are the data sources available in RSA NetWitness when creating a Reporting Engine rule?

A. Broker, Concentrator, Decoder B. IPDB, ODBC, FileReader C. NetWitness DB, Warehouse DB, Respond DB D. Short, Long, Truncated

Correct Answer: C

QUESTION NO: 2
To create meta keys that will appear in the Investigation view, you would most commonly edit configuration files on the

A. Log Decoder B. Packet Decoder C. Broker D. Concentrator

Correct Answer: D

QUESTION NO: 3
To enable reporting alerts to be sent to the Respond interface, you would

A. set up an output action in a Report B. change the capture interface in Reporting sources C. configure forwarding of alerts in the Reporting Engine configuration D. set up an output action in the Report Engine configuration

Correct Answer: C

QUESTION NO: 4
Where do you reset the password for an admin user?

A. ADMIN > System > Reset Password B. ADMIN > System > Updates > Reset Password C. ADMIN > Security > Settings > Reset Password D. ADMIN > Security > Users > Reset Password

Correct Answer: D

QUESTION NO: 5
You configure an email server for notifications for everything except the Reporting Engine in:

A. ADMIN > System > Email B. ADMIN > System > Global Notifications C. ADMIN > System > Global Auditing D. ADMIN > System > Legacy Notifications

Correct Answer: A

QUESTION NO: 6
In RSA Live, what is the deploy package option most commonly used for?

A. Deploying a resource bundle B. Subscribing to a resource C. Deploying content to the context hub D. Deploying content to air gapped networks

Correct Answer: A

QUESTION NO: 7
The NetWitness Trust Model is based on

A. User Role B. User ID C. Hardware address D. IP address

Correct Answer: A

QUESTION NO: 8
When storage on the core devices fills to capacity, what happens?

A. the oldest stored sessions are deleted and collection continues B. the decoder leverages capacity in the concentrator, and collection continues C. new traffic cannot be ingested D. the decoder leverages capacity in the broker, and collection continues

Correct Answer: A