SOPHOS ENGINEER CERTIFICATION EXAM
SCRIPT WITH SOLUTIONS 2026
◉ In which of the following circumstances would a scheduled scan
be required? Answer: scanning outside of working hours to
minimize disruptions to users
◉ Which of the following statements best describes peripheral
control? Answer: protect devices from potential malware on
removable drives
◉ Which report displays a list of all detected controlled
applications? Answer: events report
◉ When a server is locked down, what type of applications can be
run? Answer: known/trusted
◉ TRUE or FALSE: Base policies cannot be disabled. Answer: TRUE
◉ Which feature allows you to restrict applications that can run on a
protected server? Answer: server lockdown
, ◉ TRUE or FALSE: Deep learning relies on malware signatures.
Answer: FALSE
◉ You have cloned a Base Policy. How do you ensure the policy is
applied? Answer: enforce it
◉ TRUE or FALSE: Detected items are restored to their original
location if they are released from the Sophos SafeStore. Answer:
TRUE
◉ When are alerts created in Sophos Central? Answer: when action
is required
◉ Complete the sentence. Marking an alert as resolved... Answer:
...does not resolve the threat.
◉ TRUE or FALSE: When you mark an alert as resolved, Sophos
Central verifies that the threat to the endpoint or server has been
resolved. Answer: FALSE
◉ TRUE or FALSE: Sophos Central SafeStore encrypts all
quarantined items. Answer: TRUE
◉ How long, in months, do scheduled reports expire? Answer: 6
SCRIPT WITH SOLUTIONS 2026
◉ In which of the following circumstances would a scheduled scan
be required? Answer: scanning outside of working hours to
minimize disruptions to users
◉ Which of the following statements best describes peripheral
control? Answer: protect devices from potential malware on
removable drives
◉ Which report displays a list of all detected controlled
applications? Answer: events report
◉ When a server is locked down, what type of applications can be
run? Answer: known/trusted
◉ TRUE or FALSE: Base policies cannot be disabled. Answer: TRUE
◉ Which feature allows you to restrict applications that can run on a
protected server? Answer: server lockdown
, ◉ TRUE or FALSE: Deep learning relies on malware signatures.
Answer: FALSE
◉ You have cloned a Base Policy. How do you ensure the policy is
applied? Answer: enforce it
◉ TRUE or FALSE: Detected items are restored to their original
location if they are released from the Sophos SafeStore. Answer:
TRUE
◉ When are alerts created in Sophos Central? Answer: when action
is required
◉ Complete the sentence. Marking an alert as resolved... Answer:
...does not resolve the threat.
◉ TRUE or FALSE: When you mark an alert as resolved, Sophos
Central verifies that the threat to the endpoint or server has been
resolved. Answer: FALSE
◉ TRUE or FALSE: Sophos Central SafeStore encrypts all
quarantined items. Answer: TRUE
◉ How long, in months, do scheduled reports expire? Answer: 6
