SOPHOS CERTIFIED ENGINEER
EXAM (Reviewer for SOPHOS CERTIFIED ENGINEER
EXAM) 2025 Questions and Answers
Which TCP port is used to communicate policies to endpoints? --CORRECT--8190
Which Sophos Central manage product protects the data on a lost or stolen laptop? --
CORRECT--Encryption
The option to stop the AutoUpdate service is greyed out in Windows Services. What
is the most likely reason for this? --CORRECT--Tamper Protection is enabled
Complete the sentence: Signature-based file scanning relies on... --CORRECT--
previously detected malware characteristics
TRUE or FALSE: Tamper protection is enabled by default. --CORRECT--TRUE
You are unable to edit policies in Sophos Central. What do you check in Sophos
Central? --CORRECT--That you have the correct role assigned
Which URL address do you use to login to Sophos Central Partner Dashboard? -
Answer partnerportal.sophos.com
You are detecting low-reputation files and want to change the reputation level from
recommended to strict. Which policy do you edit to make this change? --CORRECT--
Threat Protection
What is the FIRST step you must take when deploying virtual environments? --
CORRECT--Check the system requirements
You want to prevent users from copying database files to USB drives without
blocking the use of all USB devices. Which policy do you need to configure? --
CORRECT--Data Loss Prevention
TRUE or FALSE: You can search for a malicious item across your network using
EDR --CORRECT--TRUE
Which log provides a record of all activities? --CORRECT--Audit log
What is the function of anti-exploit technology? --CORRECT--To detect and stop
compromised vulnerable applications
Complete the sentence: The SAV32CLI clean-up tool is a... --CORRECT--Command
line tool included in Sophos Central installation
When registering for a Sophos Central Trial, which of the following statements are
TRUE? --CORRECT--You must use an email address that has not been used with
Sophos Central before
, SOPHOS CERTIFIED ENGINEER
EXAM(Reviewer for SOPHOS
CERTIFIED ENGINEER EXAM)2023
Which tab on the device details page displays the tamper protection information? -
Answer SUMMARY
What is the function of Live Protection? --CORRECT--Connects to a cloud server to
check for the latest information about a file
How long are activities stored for in the Enterprise Dashboard? --CORRECT--90 days
What is the function of an Update Cache? --CORRECT--To download updates from
Sophos Central and store them on a dedicated server on your network
What is the function of on-access scanning? --CORRECT--Monitors running
processes' behavior
Which of the following alerts is categorized as a high alert? --CORRECT--Failed to
protect an endpoint
Which dashboard allows you to manage and apply global settings to multiple Sophos
Central accounts? --CORRECT--The Partner Dashboard
Which detection feature can prevent attacks on the master boot record? --
CORRECT--WipeGuard
What is the function of a Message Relay? --CORRECT--To enable all devices to
communicate all policy and reporting data using a dedicated server on your network
True or False: Marking an alert as acknowledge will resolve the threat on the
endpoint. --CORRECT--FALSE
Which TCP port is used to communicate Updates on endpoints? --CORRECT--8191
TRUE or FALSE: The security VM installer is linked to your Sophos Central account.
--CORRECT--FALSE
TRUE or FALSE: You can deploy an update cache without a Message Relay. --
CORRECT--TRUE
You want to change an action for 'confidential' content. Where in Sophos Central do
you make this change? --CORRECT--In the Data Loss Prevention Rule
What does HIPS do on a protected endpoint? --CORRECT--Scans for potentially
malicious behaviour
You have cloned the threat protection base policy, applied the policy to a group and
saved it. When checking the endpoint, the policy changes have not taken effect.
What do you check in the policy? --CORRECT--That the cloned policy has been
enforced
This study source was downloaded by 100000899667573 from CourseHero.com on 06-26-2025 05:14:07 GMT -05:00
https://www.coursehero.com/file/213019511/20230112104954-63bfe5d26a111-sophos-certified-engineer-exam-reviewer-for-sophos-certified-engineer-e/
EXAM (Reviewer for SOPHOS CERTIFIED ENGINEER
EXAM) 2025 Questions and Answers
Which TCP port is used to communicate policies to endpoints? --CORRECT--8190
Which Sophos Central manage product protects the data on a lost or stolen laptop? --
CORRECT--Encryption
The option to stop the AutoUpdate service is greyed out in Windows Services. What
is the most likely reason for this? --CORRECT--Tamper Protection is enabled
Complete the sentence: Signature-based file scanning relies on... --CORRECT--
previously detected malware characteristics
TRUE or FALSE: Tamper protection is enabled by default. --CORRECT--TRUE
You are unable to edit policies in Sophos Central. What do you check in Sophos
Central? --CORRECT--That you have the correct role assigned
Which URL address do you use to login to Sophos Central Partner Dashboard? -
Answer partnerportal.sophos.com
You are detecting low-reputation files and want to change the reputation level from
recommended to strict. Which policy do you edit to make this change? --CORRECT--
Threat Protection
What is the FIRST step you must take when deploying virtual environments? --
CORRECT--Check the system requirements
You want to prevent users from copying database files to USB drives without
blocking the use of all USB devices. Which policy do you need to configure? --
CORRECT--Data Loss Prevention
TRUE or FALSE: You can search for a malicious item across your network using
EDR --CORRECT--TRUE
Which log provides a record of all activities? --CORRECT--Audit log
What is the function of anti-exploit technology? --CORRECT--To detect and stop
compromised vulnerable applications
Complete the sentence: The SAV32CLI clean-up tool is a... --CORRECT--Command
line tool included in Sophos Central installation
When registering for a Sophos Central Trial, which of the following statements are
TRUE? --CORRECT--You must use an email address that has not been used with
Sophos Central before
, SOPHOS CERTIFIED ENGINEER
EXAM(Reviewer for SOPHOS
CERTIFIED ENGINEER EXAM)2023
Which tab on the device details page displays the tamper protection information? -
Answer SUMMARY
What is the function of Live Protection? --CORRECT--Connects to a cloud server to
check for the latest information about a file
How long are activities stored for in the Enterprise Dashboard? --CORRECT--90 days
What is the function of an Update Cache? --CORRECT--To download updates from
Sophos Central and store them on a dedicated server on your network
What is the function of on-access scanning? --CORRECT--Monitors running
processes' behavior
Which of the following alerts is categorized as a high alert? --CORRECT--Failed to
protect an endpoint
Which dashboard allows you to manage and apply global settings to multiple Sophos
Central accounts? --CORRECT--The Partner Dashboard
Which detection feature can prevent attacks on the master boot record? --
CORRECT--WipeGuard
What is the function of a Message Relay? --CORRECT--To enable all devices to
communicate all policy and reporting data using a dedicated server on your network
True or False: Marking an alert as acknowledge will resolve the threat on the
endpoint. --CORRECT--FALSE
Which TCP port is used to communicate Updates on endpoints? --CORRECT--8191
TRUE or FALSE: The security VM installer is linked to your Sophos Central account.
--CORRECT--FALSE
TRUE or FALSE: You can deploy an update cache without a Message Relay. --
CORRECT--TRUE
You want to change an action for 'confidential' content. Where in Sophos Central do
you make this change? --CORRECT--In the Data Loss Prevention Rule
What does HIPS do on a protected endpoint? --CORRECT--Scans for potentially
malicious behaviour
You have cloned the threat protection base policy, applied the policy to a group and
saved it. When checking the endpoint, the policy changes have not taken effect.
What do you check in the policy? --CORRECT--That the cloned policy has been
enforced
This study source was downloaded by 100000899667573 from CourseHero.com on 06-26-2025 05:14:07 GMT -05:00
https://www.coursehero.com/file/213019511/20230112104954-63bfe5d26a111-sophos-certified-engineer-exam-reviewer-for-sophos-certified-engineer-e/
