About the Certification This certification reflects the fundamental knowledge required of both the analysts using the NetWitness Platform product and the administrators managing it. This certification is the prerequisite for the next-level NetWitness Specialist certification exams.
Who Should Take the Exam
Anyone with at least one year’s experience as administrator or analyst using NetWitness Platform versions 11.3, 11.4, or 11.5.
Anyone who has successfully completed and mastered the content in these courses:
Introduction to NetWitness
NetWitness Platform Foundations
NetWitness Endpoint Foundations
NetWitness Platform Administration I
Additional Recommended Background and Experience Certification candidates are most likely to pass with a minimum of two years of experience in at least one of the following technical areas:
Information security analysis
The NetWitness Associate exam is comprised of several Domains or topical subject areas. Each Domain is represented by a series of questions designed to evaluate competence and knowledge of elements relating to that area. Exam questions for this certification include the following Domains:
% of Examination
Investigate and Analysis
General Product Knowledge
Event Stream Analysis (ESA)
Domain: Investigation & Analysis Topics include the components, content, and methods used by analysts to perform investigation and related tasks with NetWitness Platform.
General operation and analysis tools
Meta key manipulation
Navigate screen customization
Domain: Administration Topics include NetWitness Platform infrastructure, deployment and maintenance processes, and tools used by administrators of NetWitness Platform.
Overall data flow
Content and customizations
Context Menu Actions
Domain: Endpoint Topics include components, content, and processes used to investigate hosts and files.
Endpoint component functionality
Endpoint Log Hybrid
Local vs. Global scores
Blacklisting and whitelisting
Domain: General Product Knowledge Topics include basics about the NetWitness Platform, including components, services and databases.
Platform functionality and infrastructure
Distinguish functionality of Concentrators, Brokers, Archivers, Admin Server
Differentiate purpose of NetWitness Orchestrator, UEBA, Endpoint
Database types and roles
Metadata and MetaKeys
Domain: ESA Topics include use and functionality of ESA rules.
Components and concepts
Domain: Reporting Topics include report creation and customization, as well as related infrastructure.
Although NetWitness Platform product training is not a strict requirement in preparation for the exam, it is highly recommended you complete the courses listed on the first page of this guide.
The examination is administered by Pearson VUE. Their examination centers are located worldwide. Visit the Pearson VUE web site, www.pearsonvue.com/rsa/ and use the Test Center Locator to find a testing facility convenient to you.
You may also use this site to create a personal login account and register for an exam. The exam code is 07-20-NW-ASSOC01.
The exam consists of 70 multiple choice questions to be completed in 85 minutes. One valid answer should be selected for each question. The exam is computer-based and closed book – you may not utilize any printed material, personal computers, calculators, cell phones, etc. during the test.
The minimum passing score is 70%. Test results are calculated automatically at the conclusion of the test and testing center personnel can often provide you with an authorized copy of your results before you leave the testing center.
Exam Costs The fee for taking the exam is US$ 150.00.
Language Availability The Certified Associate – NetWitness exam is available in North American English.
What to expect at the Testing Center
You must present two forms of identification; one of which is a photo identification.
You will be required to electronically accept the terms of a Certification Program Non-Disclosure Agreement before beginning the examination. You are given an additional 5 minutes above and beyond the examination time to read this agreement before accepting.
Re-taking the Exam There is no limit on the number of times that you can re-take the certification exam. However, to maintain integrity and confidentiality of the test items, 14 days is the required elapsed time before retaking the test a third time. Please note that you must pay the full exam fee each time that you retake the exam.