SOPHOS ENGINEER CERTIFICATION
SCRIPT 2026 QUESTIONS WITH
SOLUTIONS GRADED A+
◍ TRUE or FALSE: All tabs are displayed for any SDU or CTR file loaded
into the SURF tool..
Answer: False
◍ In which troubleshooting phase should you confirm the steps required to
reproduce the error or symptom?.
Answer: Define the issue
◍ That the cloned policy has been enforced.
Answer: You have cloned the threat protection base policy, applied the
policy to a group and saved it. When checking the endpoint, the policy
changes have not taken effect. What do you check in the policy
◍ 8190.
Answer: Which TCP port is used to communicate policies to endpoint?
◍ To download updates from Sophos Central and store them on a dedicated
server on your network.
Answer: What is the function of an update cache?
◍ In which troubleshooting phase should you follow the steps to reproduce the
issue to confirm it is now resolved?.
Answer: Verification testing
◍ Download and run the installer from Sophos Central.
Answer: Which of the following is a method of deploying endpoint
protection?
◍ In which troubleshooting phase should you check the configuration of the
, affected function and the log files for additional information?.
Answer: Root cause analysis
◍ TRUE or FALS
E. Any Active Directory issues will return an error in the synchronization
tool when you initiate a manual synchronization..
Answer: FALSE
◍ What PowerShell command can be used to test the connection to the domain
controller from a device with the AD Sync Utility installed? (enter the name
of the command only with no additional parameters).
Answer: Test-NetConnection
◍ When configuring the Windows AD Sync Utility, which LDAP operator
would you use if you want two LDAP filters to be true?.
Answer: &
◍ Sophos uses certificate pinning. What do you need to do because of this?.
Answer: Exclude Sophos domains from TLS decryption
◍ 8191.
Answer: Which TCP port is used to communicate Updates on endpoint?
◍ False.
Answer: A message relay can be configured on a Server without an Update
Cache.
◍ True.
Answer: When protecting a MAC client, you must know the password of the
administrator.
◍ A component failed to install. When you check the log file, what words do
you search for in the log?.
Answer: error and fail
◍ Connects to a cloud server to check for the latest information about a file.
Answer: What is the function of live protection?
◍ You are investigating a failed update and suspect there is an issue with name
SCRIPT 2026 QUESTIONS WITH
SOLUTIONS GRADED A+
◍ TRUE or FALSE: All tabs are displayed for any SDU or CTR file loaded
into the SURF tool..
Answer: False
◍ In which troubleshooting phase should you confirm the steps required to
reproduce the error or symptom?.
Answer: Define the issue
◍ That the cloned policy has been enforced.
Answer: You have cloned the threat protection base policy, applied the
policy to a group and saved it. When checking the endpoint, the policy
changes have not taken effect. What do you check in the policy
◍ 8190.
Answer: Which TCP port is used to communicate policies to endpoint?
◍ To download updates from Sophos Central and store them on a dedicated
server on your network.
Answer: What is the function of an update cache?
◍ In which troubleshooting phase should you follow the steps to reproduce the
issue to confirm it is now resolved?.
Answer: Verification testing
◍ Download and run the installer from Sophos Central.
Answer: Which of the following is a method of deploying endpoint
protection?
◍ In which troubleshooting phase should you check the configuration of the
, affected function and the log files for additional information?.
Answer: Root cause analysis
◍ TRUE or FALS
E. Any Active Directory issues will return an error in the synchronization
tool when you initiate a manual synchronization..
Answer: FALSE
◍ What PowerShell command can be used to test the connection to the domain
controller from a device with the AD Sync Utility installed? (enter the name
of the command only with no additional parameters).
Answer: Test-NetConnection
◍ When configuring the Windows AD Sync Utility, which LDAP operator
would you use if you want two LDAP filters to be true?.
Answer: &
◍ Sophos uses certificate pinning. What do you need to do because of this?.
Answer: Exclude Sophos domains from TLS decryption
◍ 8191.
Answer: Which TCP port is used to communicate Updates on endpoint?
◍ False.
Answer: A message relay can be configured on a Server without an Update
Cache.
◍ True.
Answer: When protecting a MAC client, you must know the password of the
administrator.
◍ A component failed to install. When you check the log file, what words do
you search for in the log?.
Answer: error and fail
◍ Connects to a cloud server to check for the latest information about a file.
Answer: What is the function of live protection?
◍ You are investigating a failed update and suspect there is an issue with name
