MENU
When NetWitness receives a log from an event source that does not currently exist in the Admin. Event Sources list, what does it do?
Suggested Answer: C
Get Premium 050-11-CARSANWLN01 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
30 comments · newest first
BO
Bobbye
10 months ago
Pretty sure it writes to the Archiver, not the Decoder.
TA
Talia
11 months ago
Surprised it doesn't add the new Event Source automatically!
NO
Noah
11 months ago
No way, it should just ignore the log.
KA
Kaycee
11 months ago
Yeah, I agree with that!
AN
Annalee
11 months ago
I think it goes to the Decoder in transient mode.
ME
Mendy
12 months ago
I definitely recall that it doesn’t just ignore the log, but I can’t remember if it writes to the Archiver or not.
AV
Avery
12 months ago
I’m leaning towards option B, but I could also see it adding the new Event Source to the list. It’s a bit confusing.
BU
Buddy
12 months ago
I remember a practice question about how NetWitness handles unknown event sources, and I feel like it might ignore the log altogether.
LA
Lazaro
1 year ago
I think the log gets parsed to the Decoder, but I'm not sure if it's in transient mode or not.
KA
Kaitlyn
1 year ago
D seems like the most straightforward answer to me. If the event source doesn't exist, it would just ignore the log altogether. But I'm not totally confident, so I'll have to double-check my understanding.
ES
Esteban
1 year ago
Okay, I've got it! The correct answer is C. NetWitness would automatically add the new event source to the existing list, so it can properly process logs from that source going forward.
RO
Royce
1 year ago
Hmm, I'm not sure about this one. I know NetWitness has a lot of different components, so it could be doing something more complex like writing to the Archiver but not the Decoder. I'll have to think this through carefully.
DE
Deeann
1 year ago
I think the answer is B. If the event source doesn't exist, it would parse the log to the Decoder but only in transient mode, not permanently adding it to the list.
ON
Onita
2 years ago
I'm going with Option B. Parsing the log in transient mode is a good compromise - it can still process the data without permanently adding the new source. And hey, at least it's not ignoring the log completely, right?
TO
Tonette
2 years ago
It's better than ignoring the log completely, that's for sure.
DE
Deja
2 years ago
I agree, transient mode is a good compromise for handling new event sources.
CH
Cherry
2 years ago
I think Option B is a smart choice. It allows for processing without permanent addition.
ME
Merissa
2 years ago
I'm not sure, but I think it might be B) Parses the log to the Decoder, but in transient mode only.
KA
Kate
2 years ago
I agree with Jamal, it makes sense to add the new Event Source to the list.
JA
Jamal
2 years ago
I think the answer is C) Adds the new Event Source to the existing list of Event Sources.
AL
Alberta
2 years ago
Option D is just plain lazy. Ignoring the log altogether? What is this, 1990? NetWitness should be all about capturing and analyzing every bit of data it can get its hands on.
UL
Ulysses
2 years ago
I agree with Laurel. Option C is the way to go. NetWitness needs to be dynamic and adapt to new event sources, not just ignore them.
AL
Alecia
2 years ago
C) Adds the new Event Source to the existing list of Event Sources
LE
Leota
2 years ago
B) Parses the log to the Decoder, but in transient mode only
GR
Gregg
2 years ago
A) Writes the log to the Archiver but not the Decoder
LA
Laurel
2 years ago
Option C seems to be the correct answer. NetWitness should add the new Event Source to the existing list, so it can start processing logs from that source going forward.
BE
Bev
2 years ago
D) Ignores the log altogether
RO
Rosita
2 years ago
C) Adds the new Event Source to the existing list of Event Sources
WH
Whitney
2 years ago
B) Parses the log to the Decoder, but in transient mode only
JU
Judy
2 years ago
A) Writes the log to the Archiver but not the Decoder