The NetWitness Associate certification reflects the fundamental knowledge required of both the analysts using the NetWitness Platform product and the administrators managing it. This certification is the prerequisite for the next-level NW Specialist certification exams.
$110 USD ⁓ 110 Training Credits
Examination DomainsSKU: ED-NW-CERT
Exam Registration
for Customers/Partners
Exam Registration
for NetWitness Employees
Anyone with at least one year’s experience as administrator or analyst using NetWitness Platform (recommended versions 11.5 or 11.6)
and/or
Anyone who has successfully completed and mastered the content in these NetWitness Education courses:
- Introduction to NetWitness
- NetWitness Platform Foundations
- NetWitness Endpoint Foundations
- NetWitness Platform Administration I
Additional Recommended Background and Experience
Certification candidates are most likely to pass with a minimum of two years of experience in at least one of the following technical areas:
Take FREE Practice Test
for Customers/Partners
Take FREE Practice Test
for NW Employees
- Network operations
- Information security analysis
- Operating systems
- IT administration
The exam is comprised of several Domains or topical subject areas. Each Domain is represented by a series of questions designed to evaluate competence and knowledge of elements relating to that area. Exam questions for this certification include the following Domains:
|
Domain |
% of Examination |
|
Investigation & Analysis |
30% |
|
Administration |
20% |
|
Endpoint |
20% |
|
General Product Knowledge |
20% |
|
ESA |
5% |
|
Reporting |
5% |
Investigation & Analysis
Topics include the components, content, and methods used by analysts to perform investigation and related tasks with RSA NetWitness Platform.
Topic examples
- General operation and analysis tools
- Data capture
- Data queries
- Meta key manipulation
- Navigate screen customization
- Content
- Parsers
- Feeds
- Application rules
Administration
Topics include RSA NetWitness Platform infrastructure, deployment and maintenance processes, and tools used by administrators of RSA NetWitness Platform.
Topic examples
- Infrastructure functionality
- Decoders
- Brokers
- Concentrators
- Archiver
- Overall data flow
- Services
- Content and customizations
- ESA Rules
- Context Menu Actions
- Alert forwarding
- Reporting Engine
- IndexKeys
Endpoint
Topics include components, content, and processes used to investigate hosts and files.
Topic examples
- Endpoint component functionality
- Endpoint Log Hybrid
- Packager
- Relay server
- Analysis tools
- Local vs. Global scores
- Blacklisting and whitelisting
- File blocking
General Product Knowledge
Topics include basics about the RSA NetWitness Platform, including components, services and databases.
Topic examples
- Platform functionality and infrastructure
- Distinguish functionality of Concentrators, Brokers, Archivers, Admin Server
- Differentiate purpose of RSA NetWitness Orchestrator, UEBA, Endpoint
- Database types and roles
- Concepts
- Event sources
- RSA Live
- Metadata and MetaKeys
ESA
Topics include use and functionality of ESA rules.
Topic examples
- Components and concepts
- Data sources
- Enrichments
- Rule Builder
Reporting
Topics include report creation and customization, as well as related infrastructure.
Topic examples
- Report options
- Charts
- Lists
- Alerts
- Parameterization
- Components
- Databases
- Rules
Examination Preparation
Although NetWitness Platform product training is not a strict requirement in preparation for the exam, it is highly recommended you complete the courses listed.
For more about our NetWitness Platform course offerings, visit: https://community.netwitness.com/t5/netwitness-education-courses/tkb-p/netwitness-training
Exam Questions
The exam consists of 70 multiple choice questions to be completed in 85 minutes. One valid answer should be selected for each question. The exam is computer-based and closed book – you may not utilize any printed material, personal computers, calculators, cell phones, etc. during the test.
The minimum passing score is 70%. Test results are calculated automatically at the conclusion of the test and testing center personnel can often provide you with an authorized copy of your results before you leave the testing center.
Exam Costs
The fee for taking the exam is US$ 110.00.
Language Availability
NetWitness exams are available in North American English.
How is the testing conducted
Please be advise that we use the SABA Cloud testing platform to conduct the assessments. SABA uses remote proctoring technology to supervise the exam.
This help us ensure integrity of the exam, for additional details click here.
Technical Instructions before starting the exam:
Check your Internet Connectivity. Use Mozilla Firefox or Google Chrome browser. Clear your browser cache. Your Device/Laptop/PC should have a webcam. Allow Mic and Webcam access to browser. Avoid using Multiple Screens Avoid navigating to other browser tabs/windows
Re-taking the Exam
There is no limit on the number of times that you can re-take the certification exam. However, to maintain integrity and confidentiality of the test items, 14 days is the required elapsed time before retaking the test a third time. Please note that you must pay the full exam fee each time that you retake the exam.
Exam Registration
for Customers/Partners
Exam Registration
for NetWitness Employees
Additional resources
For additional questions please contacts us at education.support@netwitness.com
