SOPHOS ENGINEER EXAM 2025
QUESTIONS AND ANSWERS
You have cloned the threat protection base policy, applied the policy to a group and saved it.
When checking the endpoint, the policy changes have not taken effect. What do you check in
the policy - ANS That the cloned policy has been enforced
Which TCP port is used to communicate policies to endpoint? - ANS 8190
What is the function of an update cache? - ANS To download updates from Sophos Central
and store them on a dedicated server on your network
Which of the following is a method of deploying endpoint protection? - ANS Download and
run the installer from Sophos Central
Which TCP port is used to communicate Updates on endpoint? - ANS 8191
A message relay can be configured on a Server without an Update Cache. - ANS False
When protecting a MAC client, you must know the password of the administrator. -
ANS True
What is the function of live protection? - ANS Connects to a cloud server to check for the
latest information about a file
COPYRIGHT © 2025 BRAINBARTER ALL RIGHTS RESERVED 1
, Which is the function of Application control? - ANS To block specific applications from
running on protected endpoints
What is the function of Sophos Synchronized Security? - ANS To connect Sophos security
solutions in real time
What is the function of Web Control? - ANS Control access to websites based on their
category
What is the function of anti-exploit technology? - ANS To detect and stop compromised
vulnerable applications
Which feature of intercept X is designed to detect malware before it can execute? -
ANS Exploit technique detection
You want to change an action for 'confidential' content. Where in Sophos Central do you make
this change - ANS Data loss prevention rule
Base policies can be disabled in Sophos Central. - ANS False
You are detecting low-reputation files and want to change the reputation level from
recommended to strict. Which policy do you edit to make this change? - ANS Threat
Protection
Which endpoint protection policy protects users against malicious network traffic? -
ANS Threat protection
TRUE or FALSE: Tamper protection must be disabled before removing Endpoint protection. -
ANS True
COPYRIGHT © 2025 BRAINBARTER ALL RIGHTS RESERVED 2
QUESTIONS AND ANSWERS
You have cloned the threat protection base policy, applied the policy to a group and saved it.
When checking the endpoint, the policy changes have not taken effect. What do you check in
the policy - ANS That the cloned policy has been enforced
Which TCP port is used to communicate policies to endpoint? - ANS 8190
What is the function of an update cache? - ANS To download updates from Sophos Central
and store them on a dedicated server on your network
Which of the following is a method of deploying endpoint protection? - ANS Download and
run the installer from Sophos Central
Which TCP port is used to communicate Updates on endpoint? - ANS 8191
A message relay can be configured on a Server without an Update Cache. - ANS False
When protecting a MAC client, you must know the password of the administrator. -
ANS True
What is the function of live protection? - ANS Connects to a cloud server to check for the
latest information about a file
COPYRIGHT © 2025 BRAINBARTER ALL RIGHTS RESERVED 1
, Which is the function of Application control? - ANS To block specific applications from
running on protected endpoints
What is the function of Sophos Synchronized Security? - ANS To connect Sophos security
solutions in real time
What is the function of Web Control? - ANS Control access to websites based on their
category
What is the function of anti-exploit technology? - ANS To detect and stop compromised
vulnerable applications
Which feature of intercept X is designed to detect malware before it can execute? -
ANS Exploit technique detection
You want to change an action for 'confidential' content. Where in Sophos Central do you make
this change - ANS Data loss prevention rule
Base policies can be disabled in Sophos Central. - ANS False
You are detecting low-reputation files and want to change the reputation level from
recommended to strict. Which policy do you edit to make this change? - ANS Threat
Protection
Which endpoint protection policy protects users against malicious network traffic? -
ANS Threat protection
TRUE or FALSE: Tamper protection must be disabled before removing Endpoint protection. -
ANS True
COPYRIGHT © 2025 BRAINBARTER ALL RIGHTS RESERVED 2
