SOPHOS ENGINEER PRACTICE
EXAMINATION 2026 QUESTIONS
WITH ANSWERS GRADED A+
◍ Add the path of the application to the server lockdown policy.
Answer: What is the recommended way to allow a new application to a
locked down server?
◍ Manage endpoint software.
Answer: Components can be assisned to or removed from endpoints by
selecting the endpoint(s) from the list and selecting
◍ Server lockdown.
Answer: feature that allows you to restrict the applications that can run on
your servers, and also which of them can interact with each other.
◍ SUS detection.
Answer: Type of detection that based on properties of the file which make it
likely that is malware, however, there is less certainty because it does not
match the definition of a known piece of malwar.
◍ Server protection and intercept X advanced for servers.
Answer: Two server protection licenses
◍ Which of these zones CANNOT be customized?- LAN- WAN- DMZ-
VPN- WiFi.
Answer: VPN, this zone does not have a physical port or interface assigned
to it and therefor cannot be customized.
◍ When configuring Azure AD SSO, where can you find the redirect URL that
needs to be added to the app registration in Azure AD?.
Answer: Authentication Servers.
, ◍ Which directory service is supported by STAS when used with a Sophos
firewall?.
Answer: Microsoft Active Directory
◍ Threat cases.
Answer: are created when suspicious activity is detected on an endpoint, and
generally take around 2-3 mins to be created.
◍ Application Control.
Answer: lets you monitor and manage the applications that your users have
access to.
◍ endpoint agent and sophos security virtual machines.
Answer: Sophos two approached to protect virtual machines
◍ What is the name of the default ticket provide by Sophos?.
Answer: Appliance_Certificate_SERIAL-NUMBER
◍ When configuring SD-WAN profiles for load balancing, what two methods
can be used?.
Answer: Session persistence and Round Robin
◍ Threat hunting.
Answer: is a proactive exercise that seeks to determine the presence of an
ongoing or persistent intrusion or attack
◍ To connect Sophos security solutions in real time.
Answer: What is the function of Sophos Synchronized Security?
◍ 8190.
Answer: Which TCP port is used to communicate policies to endpoints?
◍ Threat Protection.
Answer: In which policy do you enable device isolation?
◍ Installed components.
Answer: An endpoint is reporting that Sophos Autoupdate is not installed.In
the Self-Help Tool which tab do you check to view whether AutoUpdate is
EXAMINATION 2026 QUESTIONS
WITH ANSWERS GRADED A+
◍ Add the path of the application to the server lockdown policy.
Answer: What is the recommended way to allow a new application to a
locked down server?
◍ Manage endpoint software.
Answer: Components can be assisned to or removed from endpoints by
selecting the endpoint(s) from the list and selecting
◍ Server lockdown.
Answer: feature that allows you to restrict the applications that can run on
your servers, and also which of them can interact with each other.
◍ SUS detection.
Answer: Type of detection that based on properties of the file which make it
likely that is malware, however, there is less certainty because it does not
match the definition of a known piece of malwar.
◍ Server protection and intercept X advanced for servers.
Answer: Two server protection licenses
◍ Which of these zones CANNOT be customized?- LAN- WAN- DMZ-
VPN- WiFi.
Answer: VPN, this zone does not have a physical port or interface assigned
to it and therefor cannot be customized.
◍ When configuring Azure AD SSO, where can you find the redirect URL that
needs to be added to the app registration in Azure AD?.
Answer: Authentication Servers.
, ◍ Which directory service is supported by STAS when used with a Sophos
firewall?.
Answer: Microsoft Active Directory
◍ Threat cases.
Answer: are created when suspicious activity is detected on an endpoint, and
generally take around 2-3 mins to be created.
◍ Application Control.
Answer: lets you monitor and manage the applications that your users have
access to.
◍ endpoint agent and sophos security virtual machines.
Answer: Sophos two approached to protect virtual machines
◍ What is the name of the default ticket provide by Sophos?.
Answer: Appliance_Certificate_SERIAL-NUMBER
◍ When configuring SD-WAN profiles for load balancing, what two methods
can be used?.
Answer: Session persistence and Round Robin
◍ Threat hunting.
Answer: is a proactive exercise that seeks to determine the presence of an
ongoing or persistent intrusion or attack
◍ To connect Sophos security solutions in real time.
Answer: What is the function of Sophos Synchronized Security?
◍ 8190.
Answer: Which TCP port is used to communicate policies to endpoints?
◍ Threat Protection.
Answer: In which policy do you enable device isolation?
◍ Installed components.
Answer: An endpoint is reporting that Sophos Autoupdate is not installed.In
the Self-Help Tool which tab do you check to view whether AutoUpdate is
