SOPHOS CERTIFIED ENGINEER
COMPREHENSIVE STUDY GUIDE 2026 FULL
QUESTIONS AND SOLUTIONS GRADED A+
◍ Which URL address is used to login to the Sophos Central Admin console?.
Answer: central.sophos.com
◍ TRUE or FALS
E. A mixture of Intercept X Essentials and Advanced XDR licenses can be
used within the same estate to provided different levels of protection..
Answer: TRUE
◍ What information does the Sophos Firewall share with networked devices
when a single device health status has changed to red?.
Answer: MAC Address
◍ Which of these protection features provides protection against the delivery
of malicious files or software via the Internet?.
Answer: Web Protection
◍ You have created users manually in Sophos Central. How do you prevent
the creation of duplicate users if you start synchronization with Windows
AD using the AD Sync Utility tool?.
Answer: use the same email address
◍ Which of the following directory services are supported by Sophos Central?.
Answer: Active Directory, Entra ID, Google Directory
◍ What is the installation directory of Sophos Server Protection for Linux?.
Answer: /opt/sophos-spl
◍ TRUE or FALSE: You can install a Message Relay without an Update
Cache..
, Answer: FALSE
◍ What is the best method for overriding outlying devices that may be
numerically closest to an inappropriate Update Cache?.
Answer: assign them manually
◍ TRUE or FALSE: A server can only be a member of ONE server group..
Answer: TRUE
◍ Which tab in the Endpoint Self Help Tool displays the last communication
date and time for management traffic?.
Answer: Management Communication
◍ TRUE or FALSE: Clicking Update Now in the Sophos Endpoint Agent
forces the device to communicate with the update warehouse and download
any software updates required..
Answer: TRUE
◍ TRUE or FALS
E. Tamper Protection must be disabled to remove the Sophos Endpoint
Agent from protected devices..
Answer: TRUE
◍ Which option in the peripheral control policy should be selected if you want
to allow and log the use of all peripheral devices across a network?.
Answer: monitor but don't block
◍ In which of the following circumstances would a scheduled scan be
required?.
Answer: scanning outside of working hours to minimize disruptions to users
◍ Which of the following statements best describes peripheral control?.
Answer: protect devices from potential malware on removable drives
◍ Which report displays a list of all detected controlled applications?.
Answer: events report
◍ When a server is locked down, what type of applications can be run?.
Answer: known/trusted
COMPREHENSIVE STUDY GUIDE 2026 FULL
QUESTIONS AND SOLUTIONS GRADED A+
◍ Which URL address is used to login to the Sophos Central Admin console?.
Answer: central.sophos.com
◍ TRUE or FALS
E. A mixture of Intercept X Essentials and Advanced XDR licenses can be
used within the same estate to provided different levels of protection..
Answer: TRUE
◍ What information does the Sophos Firewall share with networked devices
when a single device health status has changed to red?.
Answer: MAC Address
◍ Which of these protection features provides protection against the delivery
of malicious files or software via the Internet?.
Answer: Web Protection
◍ You have created users manually in Sophos Central. How do you prevent
the creation of duplicate users if you start synchronization with Windows
AD using the AD Sync Utility tool?.
Answer: use the same email address
◍ Which of the following directory services are supported by Sophos Central?.
Answer: Active Directory, Entra ID, Google Directory
◍ What is the installation directory of Sophos Server Protection for Linux?.
Answer: /opt/sophos-spl
◍ TRUE or FALSE: You can install a Message Relay without an Update
Cache..
, Answer: FALSE
◍ What is the best method for overriding outlying devices that may be
numerically closest to an inappropriate Update Cache?.
Answer: assign them manually
◍ TRUE or FALSE: A server can only be a member of ONE server group..
Answer: TRUE
◍ Which tab in the Endpoint Self Help Tool displays the last communication
date and time for management traffic?.
Answer: Management Communication
◍ TRUE or FALSE: Clicking Update Now in the Sophos Endpoint Agent
forces the device to communicate with the update warehouse and download
any software updates required..
Answer: TRUE
◍ TRUE or FALS
E. Tamper Protection must be disabled to remove the Sophos Endpoint
Agent from protected devices..
Answer: TRUE
◍ Which option in the peripheral control policy should be selected if you want
to allow and log the use of all peripheral devices across a network?.
Answer: monitor but don't block
◍ In which of the following circumstances would a scheduled scan be
required?.
Answer: scanning outside of working hours to minimize disruptions to users
◍ Which of the following statements best describes peripheral control?.
Answer: protect devices from potential malware on removable drives
◍ Which report displays a list of all detected controlled applications?.
Answer: events report
◍ When a server is locked down, what type of applications can be run?.
Answer: known/trusted
