050-11-CARSANWLN01

The RSA 050-11-CARSANWLN01 exam, covering RSA NetWitness Platform, focuses on the core functionalities and administration of the NetWitness Endpoint and Network sensors within the RSA Archer SIEM platform. The main points generally revolve around these key areas:

• Deployment and Configuration: Understanding how to deploy and configure both NetWitness Endpoint (formerly ArcSight Endpoint) and Network sensors. This includes network setup, sensor placement, data collection policies, and log source configuration.

• Data Ingestion and Processing: Knowledge of how NetWitness ingests data from various sources, processes it, and normalizes it for analysis. This includes understanding data flows, different data types, and the role of the NetWitness platform in aggregating and correlating security information.

• Data Analysis and Investigation: The ability to utilize the NetWitness platform for security investigation. This means understanding how to search, filter, and analyze data to identify security events and incidents. Knowing how to use various search techniques and visualization tools is crucial.

• Alerting and Reporting: Understanding how to configure alerts based on specific events or patterns and how to generate reports for security monitoring and compliance purposes. This involves creating and managing alert rules, defining thresholds, and generating customized reports.

• Management and Administration: Knowledge of the administrative tasks required to manage the NetWitness platform, including user management, system maintenance, performance tuning, and troubleshooting. This covers aspects like upgrading the system, monitoring its health, and handling failures.

• Integration with Other RSA Products: Understanding how NetWitness integrates with other RSA products, particularly RSA Archer (the SIEM it often sits within). This integration is key to its functionality and provides a holistic security view.

• Security concepts: While not always explicitly stated as a singular topic, a fundamental understanding of core security concepts, network protocols, and common attack vectors is essential for effective use and interpretation of the data within NetWitness.

The specific weighting of these areas might vary slightly depending on the version of the exam, but these represent the core competencies assessed. Always consult the official RSA exam guide for the most up-to-date and accurate information.