ETExamTower
350-201Updated 1d ago · Sep 4, 2026

Performing CyberOps Using Core Security Technologies (CBRCOR)

228 questions across 1 topics, with suggested answers, explanations where available, and imported community discussion. The first 22 questions are free to preview.

Topics

#TopicQuestionsFree
1Techniques22822

Preview

22 of 228 accessible
Question 1 · Techniques Open

Drag each function on the left to its corresponding mechanism on the right. <DragDrop items={["creates the set of executable tasks","minimizes redundancies and streamlines repetitive tasks","organizes components to seamlessly run applications","systematically executes large workflows"]} slots={[{"answer":"organizes components to seamlessly run applications","id":"orchestration_1","group":"Orchestration"},{"answer":"systematically executes large workflows","id":"orchestration_2","group":"Orchestration"},{"answer":"creates the set of executable tasks","id":"automation_1","group":"Automation"},{"answer":"minimizes redundancies and streamlines repetitive tasks","id":"automation_2","group":"Automation"}]} explanation={"Automation executes defined tasks and reduces repetitive manual work. Orchestration coordinates application components and automated tasks to execute broader, multi-step workflows.\n\n**Learn more:** [Red Hat: What is Orchestration?](https://www.redhat.com/en/topics/automation/what-is-orchestration)"} reuse={false} />

Answer: —
Question 2 · Fundamentals Open

Refer to the exhibit. An engineer is investigating a case involving suspicious usernames in Active Directory. After investigating and cross-correlating events from other sources, the engineer determines that the two users are privileged and that their creation date matches suspicious network traffic initiated from the internal network 2 days earlier. Which type of compromise is taking place?

Question exhibit
Answer: A New privileged Active Directory accounts that correlate with suspicious activity originating inside the network indicate misuse by an internal user or an attacker with internal access, which is characteristic of a compromised insider.
Question 3 · Fundamentals Open

Refer to the exhibit. Which header indicates that a page will be prevented from loading when a scripting attack is detected?

Question exhibit
Answer: C `X-XSS-Protection: 1; mode=block` enables XSS filtering and prevents the browser from rendering a page when an XSS attack is detected. [Microsoft Learn: Customize HTTP security response headers with AD FS](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/customize-http-security-headers-ad-fs) **Learn more:** [Customize HTTP security response headers with AD FS](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/customize-http-security-headers-ad-fs)