Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search instead for
Did you mean:
RSA® Certification Program
The RSA Proven Professional Certification Program offers technology professionals the knowledge, skills and credentials necessary to become a trusted adviser in deploying and maintaining RSA security system platforms.
Introduction The RSA NetWitness Platform Analyst examination is based on the critical job functions that an individual would typically be expected to perform with competence when performing analysis using RSA NetWitness Platform.
The major job functions expected of an RSA NetWitness PlatformAnalyst typically consist of the following major areas of job role responsibility: An in-depth knowledge about RSA NetWitness Platformtechnology A working knowledge of how various components (servers, hosts, and other ancillary devices) function together to monitor and help security analysts discover, investigate, and remediate advanced threats Analysis and hunting on both packets and logs using recommended methods Analysis of network traffic for suspicious activity Creation of rules for specific use cases
Candidate Background and Experience An RSA NetWitness PlatformAnalyst candidate should have a minimum of two years of professional experience in one or more of the following technical areas and understand how these technologies relate to and integrate with the RSA NetWitness Platformproduct: Previous experience in computer and Network operations, operating systems and information security. Web and Application Servers and Browsers. Analysis of network traffic and logs to identify potential threats.
The RSA NetWitness PlatformAnalyst exam is comprised of four major Domains (subject areas). Each Domain is represented by a series of questions designed to evaluate competence and knowledge of elements relating to that domain. The following table describes the proportion of the examination that relates to each domain:
% of Examination
3.0: Investigation Techniques
Domain 1.0: ESA The RSA NetWitness PlatformAnalyst must have a fundamental knowledge of Event Stream Analysis functionality and rules.
Content Areas ESA Rules - Basic rules - Alerts - Enrichments Event Correlation - Event time
Domain 2.0: Hunting The RSA NetWitness PlatformAnalyst must have a fundamental knowledge of how to use the product to find potential threats.
Domain 3.0: Investigation Techniques The RSA NetWitness PlatformAnalyst must have a fundamental knowledge of investigation functionality and techniques used to find interesting metadata.
Content Areas Meta Creation - Parsers - Feeds - Rules - Indexes Queries - Index values - Index files Investigate UI - Meta key info - Meta key order - Views - Timerange - Custom column groups - Context hub
Domain 4.0: Rules The RSA NetWitness PlatformAnalyst must have a fundamental knowledge of the types of rules and how they are used in an investigation.
Content Areas Application Rules Report Rules
Product Training Although RSA NetWitness Platform product training is not a strict requirement in preparation for the exam, it is highly recommended.Analysis of test results of RSA Certification exams indicates that a majority of candidates who attend training prior to testing are more likely to successfully pass the exam on their first attempt.
Product Experience Many of the areas addressed by the RSA NetWitness PlatformAnalyst exam will be familiar to the candidate who has worked with the RSA NetWitness Platformproduct.
The RSA NetWitness PlatformAnalyst exam content areas cover a wide range of RSA NetWitness Logs & Network product functions because an RSA NetWitness PlatformAnalyst may be called upon to detect, analyze and respond to threats using a variety of methods.
Testing Centers, Locations, and Registration
The RSA NetWitness PlatformAnalyst examination is administered by the Pearson VUE organization – an internationally known examination provider. Examination centers are located worldwide. Visit the Pearson VUE web site (http://pearsonvue.com/rsa/) and use the Test Center Locator to find a testing facility convenient to you.
You may also use the Pearson VUE site to create a personal login account and register for an exam. The RSA NetWitness PlatformAnalysis exam code is 050-11-NWLN-ANLYST01.
The RSA NetWitness PlatformAnalyst exam consists of 70 questions to be completed in 85 minutes. The exam consists of multiple-choice, multiple-response, or true/false type questions. The exam is computer-based and closed book – you may not utilize any printed material, personal computers, calculators, cell phones, etc. during the test.
The minimum passing score is 70%. Test results are calculated automatically at the conclusion of the test and testing center personnel can often provide you with an authorized copy of your results before you leave the testing center.
Exam Costs The fee for taking the exam is US$ 150.00.
Language Availability The RSA NetWitness PlatformAnalyst exam is available in North American English.
What to expect at the Testing Center
You must present two forms of identification; one of which is a photo identification.
You will be required to electronically accept the terms of an RSA Certification Program Non-Disclosure Agreement before beginning the examination. You are given an additional 5 minutes above and beyond the examination time to read this agreement before accepting.
Re-taking the Exam There is no limit on the number of times that you can re-take the certification exam. However, to maintain integrity and confidentiality of the test items, 14 days is the required elapsed time before retaking the test a third time. Please note that you must pay the full exam fee each time that you retake the