SOPHOS ENGINEER TEST SCRIPT 2026
QUESTIONS WITH FULL ANSWERS GRADED A+
◉ True. Answer: Tamper protection must be disabled before
removing Endpoint Protection.
◉ Files and Registry Entries. Answer: Two of the following are
monitored when File Integrity Monitoring is enabled
◉ Web control. Answer: Which endpoint protection policy do you
edit to block users from visiting a specific website category
◉ Give the user administrator rights to the endpoint and provide the
user with the tamper protection password. Answer: You need to give
a user access to change their protection settings in an emergency
Which 2 of the following allow you to do this?
◉ To prevent the use of removable media on protected endpoints.
Answer: What is the function of Peripheral Control?
◉ False. Answer: Deleting an endpoint Sophos Central will remove
the Endpoint agent from the endpoint.
, ◉ To detect and stop compromised vulnerable applications. Answer:
What is the function of anti-exploit technology?
◉ Command line tool included in Sophos Central installation.
Answer: The SAV32CLI clean up tool is a....
◉ Add the path of the application to the server lockdown policy.
Answer: What is the recommended way to allow a new application
to a locked down server?
◉ Update. Answer: Which section in the self-help tool should be
chhecked to starting investigating an updating issue on an endpoint
◉ False. Answer: All Endpoints have the same tamper protection
password.
◉ Isolate the computer. Answer: A malicious file has been detected
on an endpoint and you want to prevent lateral movement through
your network.
From the threat case, which action do you take?
QUESTIONS WITH FULL ANSWERS GRADED A+
◉ True. Answer: Tamper protection must be disabled before
removing Endpoint Protection.
◉ Files and Registry Entries. Answer: Two of the following are
monitored when File Integrity Monitoring is enabled
◉ Web control. Answer: Which endpoint protection policy do you
edit to block users from visiting a specific website category
◉ Give the user administrator rights to the endpoint and provide the
user with the tamper protection password. Answer: You need to give
a user access to change their protection settings in an emergency
Which 2 of the following allow you to do this?
◉ To prevent the use of removable media on protected endpoints.
Answer: What is the function of Peripheral Control?
◉ False. Answer: Deleting an endpoint Sophos Central will remove
the Endpoint agent from the endpoint.
, ◉ To detect and stop compromised vulnerable applications. Answer:
What is the function of anti-exploit technology?
◉ Command line tool included in Sophos Central installation.
Answer: The SAV32CLI clean up tool is a....
◉ Add the path of the application to the server lockdown policy.
Answer: What is the recommended way to allow a new application
to a locked down server?
◉ Update. Answer: Which section in the self-help tool should be
chhecked to starting investigating an updating issue on an endpoint
◉ False. Answer: All Endpoints have the same tamper protection
password.
◉ Isolate the computer. Answer: A malicious file has been detected
on an endpoint and you want to prevent lateral movement through
your network.
From the threat case, which action do you take?
