RSA 050-11-CARSANWLN01 Quiz 3 Topic 3 Questions 11-15

Question: 1

What happens when you set the metadata associated with a parser to Transients

ATransient means the Decoder is using the parser to parse traffic, and the generated metadata is not stored on disk

BTransient means the Decoder is using the parser to parse traffic, and the generated metadata is retained on disk for 24 hours

CTransient means the Decoder is using the parser only to filter out data, not to generate metadata

DTransient means the Decoder is using the parser only for ESA

Show Answer

Question: 2

Where do you define dynamic charts for real-time display in Dashboards'?

ADefault Dashboard

BMONITOR > Reports > Manage > Charts

CMONITOR > Reports > Charts > View

DCONFIGURE > ESA Rules

Show Answer

Question: 3

The logical operators available for Querying in Investigations depend on the Index Level of the individual meta key Which Index Level limits your query to the logical operators "exists'' and 'texists""?

AIndexNone

BIndexKeys

CIndexValues

DIndexAII

Show Answer

Question: 4

If you choose "Stop Rule Processing" in your Application Rule definition, which of the following are action choices'? (Choose three)

AKeep

BFilter

CTruncate

DIndex

ETransient

FRemove

Show Answer

Question: 5

To create a custom feed, initiate the action by selecting which top-level module'?

AInvestigate

BAdmin

CMonitor

DConfigure

Show Answer

RSA 050-11-CARSANWLN01 Quiz:3 Topic:3 Questions:11-15