SOPHOS TECHNICIAN QUESTIONS & ANSWERS
Read - Answer -What permissions does the user need to connect to AD to gather the
user and group information?
True - Answer -TRUE or FALSE: Only PE files can be restored from SafeStore through
the user interface.
Domain user - Answer -What is the minimum type of user required to connect to AD to
gather the user and group information?
Global settings > Controlled Updates - Answer -By default, computers get the latest
Sophos product updates automatically, where can an admin change this to allow control
over updates?
telnet dc.sophos.local 636 - Answer -You want to test the default SSL LDAP port for
Active Directory synchronization. Enter the command you would use to verify
connectivity to a domain controller named dc.sophos.local. _____
%ProgramData%\sophos\sophos cloud AD sync\logs - Answer -Where is the AD sync
log location?
nslookup - Answer -The Central Admin Dashboard shows that none of your endpoints
are using one of your update caches. When pinging the update cache by name it fails.
What command do you use to investigate this further?
True - Answer -TRUE or FALSE: Tamper Protection is enabled by default in Sophos
Central.
(1) Sophos Endpoint Self Help
(2) Sophos Central - Answer -Which 2 methods does Sophos provide that will display
the status of all Sophos services on Windows computers? Choose two (2).
The connection was blocked but the root cause has NOT been cleaned up - Answer -
Which of the following statements is TRUE for a C2/Generic-C detection?
Active Directory Sync Utility - Answer -Where do you check to see if the AD sync
schedule has been configured correctly?
Global Settings - Answer -Where can the AD Sync tool be obtained from?
To detect man-in-the-middle attacks - Answer -What is the function of Safe Browsing in
Intercept X?
(1) Program Data\Sophos\SafeStore
, (2) Program Data\Sophos\Sophos Anti-Virus\SafeStore - Answer -Where can you find
the SafeStore quarantine folders on a Windows Endpoint? Choose two (2).
Resolve and verify - Answer -What is the third step of the troubleshooting process?
(1) The threat was found in an archive
(2) The threat was found in a mailbox - Answer -Which 2 of the following are reasons
why manual cleanup may be required? Choose two (2).
True - Answer -TRUE or FALSE: You can recover the Tamper Protection password for
a deleted endpoint in Sophos Central.
True - Answer -TRUE or FALSE: Sophos recommends disabling HTTPS inspection for
Sophos updating traffic.
389 - Answer -AD Sync is not working, you have successfully pinged the DC by both
name and IP address. Which port do you use with telnet to confirm the LDAP port is
accessible?
C:\ProgramData\Sophos\AutoUpdate\data\warehouse - Answer -What is the location of
AutoUpdate's warehouse on a protected endpoint?
(1) Germany
(2) United States
(3) Ireland - Answer -When setting up a new Sophos Central account, which 3 of the
following are the datacentre locations you may select? Choose three (3).
(1) Ability to disable Tamper Protection
(2) Administrative rights to the network and AD
(3) Administrative rights to the endpoint - Answer -Which 3 of the following are required
to perform troubleshooting on an endpoint? Choose three (3).
Use settings > website management to override the category for the website URL to
one which is not blocked - Answer -Web Control has been configured to block access
to a category, but this is preventing access to a desired location. Which of the following
methods can be used to allow access to this site without allowing access to other sites
in the same category?
%ProgramData%\Sophos\CloudInstaller\Logs - Answer -Where is the
'SophosCloudInstaller_<time_and_date_stamp>.log' found?
False - Answer -TRUE or FALSE: The default Update Cache TCP port of 8191 can be
modified.
nslookup - Answer -Which of the following Windows tools do you use to resolve IP
addresses to hostnames and hostnames to IP addresses?
Read - Answer -What permissions does the user need to connect to AD to gather the
user and group information?
True - Answer -TRUE or FALSE: Only PE files can be restored from SafeStore through
the user interface.
Domain user - Answer -What is the minimum type of user required to connect to AD to
gather the user and group information?
Global settings > Controlled Updates - Answer -By default, computers get the latest
Sophos product updates automatically, where can an admin change this to allow control
over updates?
telnet dc.sophos.local 636 - Answer -You want to test the default SSL LDAP port for
Active Directory synchronization. Enter the command you would use to verify
connectivity to a domain controller named dc.sophos.local. _____
%ProgramData%\sophos\sophos cloud AD sync\logs - Answer -Where is the AD sync
log location?
nslookup - Answer -The Central Admin Dashboard shows that none of your endpoints
are using one of your update caches. When pinging the update cache by name it fails.
What command do you use to investigate this further?
True - Answer -TRUE or FALSE: Tamper Protection is enabled by default in Sophos
Central.
(1) Sophos Endpoint Self Help
(2) Sophos Central - Answer -Which 2 methods does Sophos provide that will display
the status of all Sophos services on Windows computers? Choose two (2).
The connection was blocked but the root cause has NOT been cleaned up - Answer -
Which of the following statements is TRUE for a C2/Generic-C detection?
Active Directory Sync Utility - Answer -Where do you check to see if the AD sync
schedule has been configured correctly?
Global Settings - Answer -Where can the AD Sync tool be obtained from?
To detect man-in-the-middle attacks - Answer -What is the function of Safe Browsing in
Intercept X?
(1) Program Data\Sophos\SafeStore
, (2) Program Data\Sophos\Sophos Anti-Virus\SafeStore - Answer -Where can you find
the SafeStore quarantine folders on a Windows Endpoint? Choose two (2).
Resolve and verify - Answer -What is the third step of the troubleshooting process?
(1) The threat was found in an archive
(2) The threat was found in a mailbox - Answer -Which 2 of the following are reasons
why manual cleanup may be required? Choose two (2).
True - Answer -TRUE or FALSE: You can recover the Tamper Protection password for
a deleted endpoint in Sophos Central.
True - Answer -TRUE or FALSE: Sophos recommends disabling HTTPS inspection for
Sophos updating traffic.
389 - Answer -AD Sync is not working, you have successfully pinged the DC by both
name and IP address. Which port do you use with telnet to confirm the LDAP port is
accessible?
C:\ProgramData\Sophos\AutoUpdate\data\warehouse - Answer -What is the location of
AutoUpdate's warehouse on a protected endpoint?
(1) Germany
(2) United States
(3) Ireland - Answer -When setting up a new Sophos Central account, which 3 of the
following are the datacentre locations you may select? Choose three (3).
(1) Ability to disable Tamper Protection
(2) Administrative rights to the network and AD
(3) Administrative rights to the endpoint - Answer -Which 3 of the following are required
to perform troubleshooting on an endpoint? Choose three (3).
Use settings > website management to override the category for the website URL to
one which is not blocked - Answer -Web Control has been configured to block access
to a category, but this is preventing access to a desired location. Which of the following
methods can be used to allow access to this site without allowing access to other sites
in the same category?
%ProgramData%\Sophos\CloudInstaller\Logs - Answer -Where is the
'SophosCloudInstaller_<time_and_date_stamp>.log' found?
False - Answer -TRUE or FALSE: The default Update Cache TCP port of 8191 can be
modified.
nslookup - Answer -Which of the following Windows tools do you use to resolve IP
addresses to hostnames and hostnames to IP addresses?
