SOPHOS FIREWALL ENGINEER EXAM 2026
COMPLETE QUESTIONS AND SOLUTIONS
◉ What is the function of an Update Cache? Answer: To download
updates from Sophos Central and store them on a dedicated server
on your network
◉ What is the function of on-access scanning? Answer: Monitors
running processes' behavior
◉ Which of the following alerts is categorized as a high alert?
Answer: Failed to protect an endpoint
◉ Which dashboard allows you to manage and apply global settings
to multiple Sophos Central accounts? Answer: The Partner
Dashboard
◉ Which detection feature can prevent attacks on the master boot
record? Answer: WipeGuard
◉ What is the function of a Message Relay? Answer: To enable all
devices to communicate all policy and reporting data using a
dedicated server on your network
, ◉ True or False: Marking an alert as acknowledge will resolve the
threat on the endpoint. Answer: FALSE
◉ Which TCP port is used to communicate Updates on endpoints?
Answer: 8191
◉ TRUE or FALSE: The security VM installer is linked to your Sophos
Central account. Answer: FALSE
◉ TRUE or FALSE: You can deploy an update cache without a
Message Relay. Answer: TRUE
◉ You want to change an action for 'confidential' content. Where in
Sophos Central do you make this change? Answer: In the Data Loss
Prevention Rule
◉ What does HIPS do on a protected endpoint? Answer: Scans for
potentially malicious behaviour
◉ You have cloned the threat protection base policy, applied the
policy to a group and saved it. When checking the endpoint, the
policy changes have not taken effect. What do you check in the
policy? Answer: That the cloned policy has been enforced
COMPLETE QUESTIONS AND SOLUTIONS
◉ What is the function of an Update Cache? Answer: To download
updates from Sophos Central and store them on a dedicated server
on your network
◉ What is the function of on-access scanning? Answer: Monitors
running processes' behavior
◉ Which of the following alerts is categorized as a high alert?
Answer: Failed to protect an endpoint
◉ Which dashboard allows you to manage and apply global settings
to multiple Sophos Central accounts? Answer: The Partner
Dashboard
◉ Which detection feature can prevent attacks on the master boot
record? Answer: WipeGuard
◉ What is the function of a Message Relay? Answer: To enable all
devices to communicate all policy and reporting data using a
dedicated server on your network
, ◉ True or False: Marking an alert as acknowledge will resolve the
threat on the endpoint. Answer: FALSE
◉ Which TCP port is used to communicate Updates on endpoints?
Answer: 8191
◉ TRUE or FALSE: The security VM installer is linked to your Sophos
Central account. Answer: FALSE
◉ TRUE or FALSE: You can deploy an update cache without a
Message Relay. Answer: TRUE
◉ You want to change an action for 'confidential' content. Where in
Sophos Central do you make this change? Answer: In the Data Loss
Prevention Rule
◉ What does HIPS do on a protected endpoint? Answer: Scans for
potentially malicious behaviour
◉ You have cloned the threat protection base policy, applied the
policy to a group and saved it. When checking the endpoint, the
policy changes have not taken effect. What do you check in the
policy? Answer: That the cloned policy has been enforced
