SOPHOS ENGINEER ACTUAL EXAM
PAPER 2026 QUESTIONS WITH
ANSWERS GRADED A+
◍ True.
Answer: TRUE or FALSE: Sophos recommends disabling HTTPS
inspection for MCS traffic.
◍ ping 172.16.2.20.
Answer: Enter the command you would use to test IP network connectivity
to the address 172.16.2.20. _____
◍ 389.
Answer: AD Sync is not working, you have successfully pinged the DC by
both name and IP address. Which port do you use with telnet to confirm the
LDAP port is accessible?
◍ 1. The certificate2. SHA-2563. The file paths.
Answer: In which 3 ways can you allow a quarantined file to be restored?
Choose three (3).
◍ netsh winhttp reset proxy.
Answer: Enter the command you would use to remove the currently
configured system proxy.
◍ %ProgramData%\Sophos\CloudInstaller\Logs.
Answer: Where is the 'SophosCloudInstaller_<time_and_date_stamp>.log'
found?
◍ SHA-256The file pathsThe certificate.
Answer: In which 3 ways can you allow a quarantined file to be restored?
◍ Ability to disable Tamper ProtectionAdministrative rights to the network
, and ADAdministrative rights to the endpoint.
Answer: Which 3 of the following are required to perform troubleshooting
on an endpoint? Choose three (3).
◍ --crtcatalogpath.
Answer: Which switch can be used with SophosSetup.exe to point to the
name and location of a custom catalog file?
◍ POLICY ENFORCED.
Answer: You have added a new Threat Protection policy that will apply to
all Windows endpoints but want to disable it until you can test the settings.
Which tab should you use to disable it?
◍ True.
Answer: TRUE or FALSE: Only PE files can be restored from SafeStore
through the user interface.
◍ nan.
Answer: Enter the command you would use to resolve the IP address of
srv.sophos.local and test network connectivity to the server at the same time.
_____
◍ False.
Answer: TRUE or FALSE: The Sophos Diagnostic Utility is available for
Windows endpoints only.
◍ The threat was found in an archiveThe threat was found in a mailbox.
Answer: Which 2 of the following are reasons why manual cleanup may be
required? Choose two (2).
◍ An unknown fileAn executable file in a temporary file location.
Answer: Which 2 of the following are malicious file indicators? Choose two
(2).
◍ From the device pageFrom a threat case.
Answer: In which 2 places can you create a forensic snapshot?
◍ The Update Cache server has run out of disc space.
PAPER 2026 QUESTIONS WITH
ANSWERS GRADED A+
◍ True.
Answer: TRUE or FALSE: Sophos recommends disabling HTTPS
inspection for MCS traffic.
◍ ping 172.16.2.20.
Answer: Enter the command you would use to test IP network connectivity
to the address 172.16.2.20. _____
◍ 389.
Answer: AD Sync is not working, you have successfully pinged the DC by
both name and IP address. Which port do you use with telnet to confirm the
LDAP port is accessible?
◍ 1. The certificate2. SHA-2563. The file paths.
Answer: In which 3 ways can you allow a quarantined file to be restored?
Choose three (3).
◍ netsh winhttp reset proxy.
Answer: Enter the command you would use to remove the currently
configured system proxy.
◍ %ProgramData%\Sophos\CloudInstaller\Logs.
Answer: Where is the 'SophosCloudInstaller_<time_and_date_stamp>.log'
found?
◍ SHA-256The file pathsThe certificate.
Answer: In which 3 ways can you allow a quarantined file to be restored?
◍ Ability to disable Tamper ProtectionAdministrative rights to the network
, and ADAdministrative rights to the endpoint.
Answer: Which 3 of the following are required to perform troubleshooting
on an endpoint? Choose three (3).
◍ --crtcatalogpath.
Answer: Which switch can be used with SophosSetup.exe to point to the
name and location of a custom catalog file?
◍ POLICY ENFORCED.
Answer: You have added a new Threat Protection policy that will apply to
all Windows endpoints but want to disable it until you can test the settings.
Which tab should you use to disable it?
◍ True.
Answer: TRUE or FALSE: Only PE files can be restored from SafeStore
through the user interface.
◍ nan.
Answer: Enter the command you would use to resolve the IP address of
srv.sophos.local and test network connectivity to the server at the same time.
_____
◍ False.
Answer: TRUE or FALSE: The Sophos Diagnostic Utility is available for
Windows endpoints only.
◍ The threat was found in an archiveThe threat was found in a mailbox.
Answer: Which 2 of the following are reasons why manual cleanup may be
required? Choose two (2).
◍ An unknown fileAn executable file in a temporary file location.
Answer: Which 2 of the following are malicious file indicators? Choose two
(2).
◍ From the device pageFrom a threat case.
Answer: In which 2 places can you create a forensic snapshot?
◍ The Update Cache server has run out of disc space.
