SOPHOS ENGINEER MAIN EXAMS SCRIPT 2025/2026
QUESTIONS WITH ANSWERS RATED A+
✔✔Files, network - ✔✔threat search results are split into which 2 of the following?
✔✔Tool that identified where malicious files are written from - ✔✔The source of
infection clean up tool is..
✔✔Modifying protection settings, uninstalling the endpoint agent - ✔✔Which 2 of the
following does tamper protection prevent users from doing?
✔✔Installed Components - ✔✔An endpoint is reporting that Sophos AutoUpdate is not
installed. In the Self-Help Tool which tab do you check to view whether AutoUpdate is
listed as installed?
✔✔Super Admin - ✔✔What is the minimum administrative role that will allows a user to
manage roles and role assignments?
✔✔previously detected malware characteristics - ✔✔Signature-based file scanning
relies on...
✔✔Help Desk - ✔✔Which is the minimum administrative role that will allow a user to
view alerts, perform updates and scan endpoints
✔✔True - ✔✔Tamper protection is enabled by default?
✔✔Threat Protection - ✔✔You want to mitigate exploits in vulnerable applications.
Which policy do you enable the features in?
✔✔Machine learning - ✔✔Which of the following is a pre-execution check performed by
intercept X
✔✔Ransomware - ✔✔Which security threat does Intercept X protect against?
✔✔Disable tamper protection for their endpoint, Provide the user with the tamper
protection password - ✔✔You need to give a user access to change their protection
settings in an emergency. Which 2 of the following allow you to do this?
✔✔False - ✔✔TRUE or FALSE: Deleting an endpoint in Sophos central will remove the
endpoint agent from the endpoint.
✔✔Command line tool included in Sophos central installation - ✔✔The SAV32CLI clean
up tool is a...
, ✔✔Add the path of the application to the server lockdown policy - ✔✔What is the
recommended way to allow a new application to a locked down server?
✔✔SophosLabs - ✔✔Which Sophos support tool do you use to find out the latest
information about security threats?
✔✔False - ✔✔TRUE or FALSE: All server protection features are enabled by default.
✔✔Server lockdown - ✔✔Which feature allows you to restrict applications on a server
✔✔True - ✔✔True or False: You can choose to send email alerts immediately, hourly,
daily or never.
✔✔Separate download that detects and removes malware - ✔✔The Virus Removal
clean up tool is a...
✔✔Licensing - ✔✔Where can an administrator view the license management types in
the Enterprise Dashboard?
✔✔The Partner Dashboard - ✔✔Which dashboard allows you to manage and apply
global settings to multiple Sophos Central accounts?
✔✔Account Details - ✔✔Where in Sophos Central Admin Console can you enable
remote assistance?
✔✔To enable all devices to communicate all policy and reporting data using a dedicated
server on your network - ✔✔What is the function of a Message Relay?
✔✔To prevent the use of removable media on protected endpoints - ✔✔What is the
function of Peripheral Control?
✔✔Global Settings and sever policy - ✔✔Which 2 places in Sophos Central do you add
exclusions for servers?
✔✔partnerportal.sophos.com - ✔✔Which URL address do you use to login to Sophos
Central Partner Dashboard?
✔✔True - ✔✔TRUE or FALSE: You can search for a malicious item across your
network using EDR
✔✔Data Loss Prevention - ✔✔You want to prevent users from copying database files to
USB drives without blocking the use of all USB devices. Which policy do you need to
configure?
QUESTIONS WITH ANSWERS RATED A+
✔✔Files, network - ✔✔threat search results are split into which 2 of the following?
✔✔Tool that identified where malicious files are written from - ✔✔The source of
infection clean up tool is..
✔✔Modifying protection settings, uninstalling the endpoint agent - ✔✔Which 2 of the
following does tamper protection prevent users from doing?
✔✔Installed Components - ✔✔An endpoint is reporting that Sophos AutoUpdate is not
installed. In the Self-Help Tool which tab do you check to view whether AutoUpdate is
listed as installed?
✔✔Super Admin - ✔✔What is the minimum administrative role that will allows a user to
manage roles and role assignments?
✔✔previously detected malware characteristics - ✔✔Signature-based file scanning
relies on...
✔✔Help Desk - ✔✔Which is the minimum administrative role that will allow a user to
view alerts, perform updates and scan endpoints
✔✔True - ✔✔Tamper protection is enabled by default?
✔✔Threat Protection - ✔✔You want to mitigate exploits in vulnerable applications.
Which policy do you enable the features in?
✔✔Machine learning - ✔✔Which of the following is a pre-execution check performed by
intercept X
✔✔Ransomware - ✔✔Which security threat does Intercept X protect against?
✔✔Disable tamper protection for their endpoint, Provide the user with the tamper
protection password - ✔✔You need to give a user access to change their protection
settings in an emergency. Which 2 of the following allow you to do this?
✔✔False - ✔✔TRUE or FALSE: Deleting an endpoint in Sophos central will remove the
endpoint agent from the endpoint.
✔✔Command line tool included in Sophos central installation - ✔✔The SAV32CLI clean
up tool is a...
, ✔✔Add the path of the application to the server lockdown policy - ✔✔What is the
recommended way to allow a new application to a locked down server?
✔✔SophosLabs - ✔✔Which Sophos support tool do you use to find out the latest
information about security threats?
✔✔False - ✔✔TRUE or FALSE: All server protection features are enabled by default.
✔✔Server lockdown - ✔✔Which feature allows you to restrict applications on a server
✔✔True - ✔✔True or False: You can choose to send email alerts immediately, hourly,
daily or never.
✔✔Separate download that detects and removes malware - ✔✔The Virus Removal
clean up tool is a...
✔✔Licensing - ✔✔Where can an administrator view the license management types in
the Enterprise Dashboard?
✔✔The Partner Dashboard - ✔✔Which dashboard allows you to manage and apply
global settings to multiple Sophos Central accounts?
✔✔Account Details - ✔✔Where in Sophos Central Admin Console can you enable
remote assistance?
✔✔To enable all devices to communicate all policy and reporting data using a dedicated
server on your network - ✔✔What is the function of a Message Relay?
✔✔To prevent the use of removable media on protected endpoints - ✔✔What is the
function of Peripheral Control?
✔✔Global Settings and sever policy - ✔✔Which 2 places in Sophos Central do you add
exclusions for servers?
✔✔partnerportal.sophos.com - ✔✔Which URL address do you use to login to Sophos
Central Partner Dashboard?
✔✔True - ✔✔TRUE or FALSE: You can search for a malicious item across your
network using EDR
✔✔Data Loss Prevention - ✔✔You want to prevent users from copying database files to
USB drives without blocking the use of all USB devices. Which policy do you need to
configure?
