SOPHOS CERTIFIED ENGINEER EXAM SCRIPT
2026 COMPLETE ANSWERS VERIFIED
◉ Which of the following alerts is categorized as a high alert?
Answer: Failed to protect an endpoint
◉ Which dashboard allows you to manage and apply global settings
to multiple Sophos Central accounts? Answer: The Partner
Dashboard
◉ Which detection feature can prevent attacks on the master boot
record? Answer: WipeGuard
◉ What is the function of a Message Relay? Answer: To enable all
devices to communicate all policy and reporting data using a
dedicated server on your network
◉ True or False: Marking an alert as acknowledge will resolve the
threat on the endpoint. Answer: FALSE
◉ Which TCP port is used to communicate Updates on endpoints?
Answer: 8191
, ◉ TRUE or FALSE: The security VM installer is linked to your Sophos
Central account. Answer: FALSE
◉ TRUE or FALSE: You can deploy an update cache without a
Message Relay. Answer: TRUE
◉ You want to change an action for 'confidential' content. Where in
Sophos Central do you make this change? Answer: In the Data Loss
Prevention Rule
◉ What does HIPS do on a protected endpoint? Answer: Scans for
potentially malicious behaviour
◉ You have cloned the threat protection base policy, applied the
policy to a group and saved it. When checking the endpoint, the
policy changes have not taken effect. What do you check in the
policy? Answer: That the cloned policy has been enforced
◉ In which 2 ways can you license the Enterprise Dashboard?
Answer: (1) Master Licensing
(2) Individual Licensing
◉ What is the minimum administrative role that will allow a user to
create and edit policies? Answer: Admin
2026 COMPLETE ANSWERS VERIFIED
◉ Which of the following alerts is categorized as a high alert?
Answer: Failed to protect an endpoint
◉ Which dashboard allows you to manage and apply global settings
to multiple Sophos Central accounts? Answer: The Partner
Dashboard
◉ Which detection feature can prevent attacks on the master boot
record? Answer: WipeGuard
◉ What is the function of a Message Relay? Answer: To enable all
devices to communicate all policy and reporting data using a
dedicated server on your network
◉ True or False: Marking an alert as acknowledge will resolve the
threat on the endpoint. Answer: FALSE
◉ Which TCP port is used to communicate Updates on endpoints?
Answer: 8191
, ◉ TRUE or FALSE: The security VM installer is linked to your Sophos
Central account. Answer: FALSE
◉ TRUE or FALSE: You can deploy an update cache without a
Message Relay. Answer: TRUE
◉ You want to change an action for 'confidential' content. Where in
Sophos Central do you make this change? Answer: In the Data Loss
Prevention Rule
◉ What does HIPS do on a protected endpoint? Answer: Scans for
potentially malicious behaviour
◉ You have cloned the threat protection base policy, applied the
policy to a group and saved it. When checking the endpoint, the
policy changes have not taken effect. What do you check in the
policy? Answer: That the cloned policy has been enforced
◉ In which 2 ways can you license the Enterprise Dashboard?
Answer: (1) Master Licensing
(2) Individual Licensing
◉ What is the minimum administrative role that will allow a user to
create and edit policies? Answer: Admin
