SOPHOS CERTIFIED ENGINEER EXAM QUESTIONS
WITH CORRECT ANSWERS REVISED 2025
1. WhichTCP port is used to communicate policies to endpoints?:correct answer:
| | | | | | | | | |
8190
|
2. WhichSophos Centralmanageproduct protectsthedataon alostorstolen
| | | | | | | | | | | |
laptop?:correct answer: Encryption
| | |
3. The option to stop the AutoUpdate service is greyed out in Windows Ser-vices.
| | | | | | | | | | | |
What is the most likely reason for this?:correct answer:Tamper Protection is enabled
| | | | | | | | | | | | |
4. TRUE or FALSE:correctanswer:Tamper protection is enabledbydefault.:correct
| | | | | | | |
answer: TRUE
| |
5. Completethe sentence:correct answer:Signature-basedfilescanningrelies | | | | | | |
on...:correct answer: previouslydetected malware characteristics
| | | | |
6. You are unable to edit policies in Sophos Central.What do you check inSophos
| | | | | | | | | | | | |
Central?:correct answer: That you have the correct role assigned
| | | | | | | | |
7. Which URL address do you use to login to Sophos Central Partner Dash-
| | | | | | | | | | | |
board?:correct answer: partnerportal.sophos.com
| | |
8. You are detecting low-reputation files and want to change the reputationlevel from
| | | | | | | | | | |
recommended to strict. Which policy do you edit to make this change?:correct answer:
| | | | | | | | | | | | |
Threat Protection
| |
9. What is the FIRST step you must take when deploying virtual environ-
| | | | | | | | | | |
ments?:correct answer: Check the system requirements
| | | | | |
10. You want to prevent users from copying database files to USB driveswithout | | | | | | | | | | |
blocking the use of all USB devices. Which policy do you need toconfigure?:correct
| | | | | | | | | | | | |
answer: Data Loss Prevention
| | | |
11. TRUE or FALSE:correct answer: You can search for a malicious item across | | | | | | | | | | |
your networkusing EDR:correct answer: TRUE
| | | | |
12. Which log provides a record of all activities?:correct answer:Audit log | | | | | | | | | |
13. Whatisthefunctionofanti-exploittechnology?:correct answer: Todetectand | | | | | | | | | |
stop compro-mised vulnerable applications
| | | |
14. Complete the sentence:correct answer:The SAV32CLI clean-up tool is | | | | | | |
a...:correct answer: Command linetool included in Sophos Central installation
| | | | | | | | |
15. When registering for a Sophos Central Trial, which of the following state- | | | | | | | | | | |
ments are TRUE?:correct answer: You must use an email address that has not been
| | | | | | | | | | | | | |
used with Sophos Central before
| | | | |
16. Which tab on the device details page displays the tamper protection infor- | | | | | | | | | | |
mation?:correct answer: SUMMARY
| | |
17. What is the function of Live Protection?:correct answer: Connects to a cloud | | | | | | | | | | |
1 |/ |6
, serverto checkfor the latest information about a file
| | | | | | | |
18. How long are activities stored for in the Enterprise Dashboard?:correct
| | | | | | | | |
answer: 90 days
| | |
19. What isthefunctionofanUpdateCache?:correct answer: Todownload | | | | | | | | | |
updatesfromSophosCentral and store them on a dedicated server on your network
| | | | | | | | | | | | |
20. What is the function of on-access scanning?:correct answer: Monitors | | | | | | | |
running processes'behavior
| |
21. Whichofthefollowingalertsiscategorizedasahighalert?:correct answer: | | | | | | | | | | |
Failed to protectan endpoint
| | | |
22. Which dashboard allows you to manage and apply global settings tomultiple | | | | | | | | | |
Sophos Central accounts?:correct answer: The Partner Dashboard
| | | | | | |
23. Which detection featurecan prevent attacks on the masterboot | | | | | | | | |
record?:correct answer: -
| | |
WipeGuard
24. What is the function of a Message Relay?:correct answer: To enable all | | | | | | | | | | |
devices to commu-nicate all policy and reporting data using a dedicated server on
| | | | | | | | | | | | |
your network
| |
25. True or False:correct answer:Marking an alert as acknowledge will resolve
| | | | | | | | | |
the threat onthe endpoint.:correct answer: FALSE
| | | | | |
26. WhichTCP port is used to communicate Updates on endpoints?:correct | | | | | | | | |
answer: 8191
| |
27. TRUEor FALSE:correct answer:The securityVMinstaller islinked toyour | | | | | | | | | |
Sophos Centralaccount.:correct answer: FALSE
| | | |
28. TRUE or FALSE:correct answer:You can deploy an update cache without a | | | | | | | | | |
MessageRelay.:correct answer: TRUE
| | |
29. You want to change an action for 'confidential' content.Where in Sophos
| | | | | | | | | | |
Central do you make this change?:correct answer:In the Data Loss Prevention Rule
| | | | | | | | | | | | |
30. WhatdoesHIPSdoonaprotectedendpoint?:correct answer: Scansfor | | | | | | | | | |
potentiallymaliciousbehaviour
| |
31. You have cloned the threat protection base policy, applied the policy to a
| | | | | | | | | | | |
group and saved it.When checking the endpoint, the policy changes have nottaken
| | | | | | | | | | | |
effect.What do you check in the policy?:correct answer: That the cloned policy has
| | | | | | | | | | | | | |
beenenforced
|
32. In which 2 ways can you license the Enterprise Dashboard?:correct answer:
| | | | | | | | | |
(1) MasterLicensing
(2) Individual Licensing |
33. Whatis theminimumadministrativerolethatwillallowa userto createandedit| | | | | | | | | | | | |
policies?:correct answer: Admin
| | |
34. Complete the following sentence:correct answer:The default protection base | | | | | | | |
policy isconfigured with...:correct answer: Sophos' recommended settings
| | | | | | |
35. WhichsectionintheSelf-Helptoolshouldbecheckedtostartinvestigatingan | | | | | | | | | | |
updating issue on an endpoint:correct answer: System
| | | | | | |
2 |/ |6
WITH CORRECT ANSWERS REVISED 2025
1. WhichTCP port is used to communicate policies to endpoints?:correct answer:
| | | | | | | | | |
8190
|
2. WhichSophos Centralmanageproduct protectsthedataon alostorstolen
| | | | | | | | | | | |
laptop?:correct answer: Encryption
| | |
3. The option to stop the AutoUpdate service is greyed out in Windows Ser-vices.
| | | | | | | | | | | |
What is the most likely reason for this?:correct answer:Tamper Protection is enabled
| | | | | | | | | | | | |
4. TRUE or FALSE:correctanswer:Tamper protection is enabledbydefault.:correct
| | | | | | | |
answer: TRUE
| |
5. Completethe sentence:correct answer:Signature-basedfilescanningrelies | | | | | | |
on...:correct answer: previouslydetected malware characteristics
| | | | |
6. You are unable to edit policies in Sophos Central.What do you check inSophos
| | | | | | | | | | | | |
Central?:correct answer: That you have the correct role assigned
| | | | | | | | |
7. Which URL address do you use to login to Sophos Central Partner Dash-
| | | | | | | | | | | |
board?:correct answer: partnerportal.sophos.com
| | |
8. You are detecting low-reputation files and want to change the reputationlevel from
| | | | | | | | | | |
recommended to strict. Which policy do you edit to make this change?:correct answer:
| | | | | | | | | | | | |
Threat Protection
| |
9. What is the FIRST step you must take when deploying virtual environ-
| | | | | | | | | | |
ments?:correct answer: Check the system requirements
| | | | | |
10. You want to prevent users from copying database files to USB driveswithout | | | | | | | | | | |
blocking the use of all USB devices. Which policy do you need toconfigure?:correct
| | | | | | | | | | | | |
answer: Data Loss Prevention
| | | |
11. TRUE or FALSE:correct answer: You can search for a malicious item across | | | | | | | | | | |
your networkusing EDR:correct answer: TRUE
| | | | |
12. Which log provides a record of all activities?:correct answer:Audit log | | | | | | | | | |
13. Whatisthefunctionofanti-exploittechnology?:correct answer: Todetectand | | | | | | | | | |
stop compro-mised vulnerable applications
| | | |
14. Complete the sentence:correct answer:The SAV32CLI clean-up tool is | | | | | | |
a...:correct answer: Command linetool included in Sophos Central installation
| | | | | | | | |
15. When registering for a Sophos Central Trial, which of the following state- | | | | | | | | | | |
ments are TRUE?:correct answer: You must use an email address that has not been
| | | | | | | | | | | | | |
used with Sophos Central before
| | | | |
16. Which tab on the device details page displays the tamper protection infor- | | | | | | | | | | |
mation?:correct answer: SUMMARY
| | |
17. What is the function of Live Protection?:correct answer: Connects to a cloud | | | | | | | | | | |
1 |/ |6
, serverto checkfor the latest information about a file
| | | | | | | |
18. How long are activities stored for in the Enterprise Dashboard?:correct
| | | | | | | | |
answer: 90 days
| | |
19. What isthefunctionofanUpdateCache?:correct answer: Todownload | | | | | | | | | |
updatesfromSophosCentral and store them on a dedicated server on your network
| | | | | | | | | | | | |
20. What is the function of on-access scanning?:correct answer: Monitors | | | | | | | |
running processes'behavior
| |
21. Whichofthefollowingalertsiscategorizedasahighalert?:correct answer: | | | | | | | | | | |
Failed to protectan endpoint
| | | |
22. Which dashboard allows you to manage and apply global settings tomultiple | | | | | | | | | |
Sophos Central accounts?:correct answer: The Partner Dashboard
| | | | | | |
23. Which detection featurecan prevent attacks on the masterboot | | | | | | | | |
record?:correct answer: -
| | |
WipeGuard
24. What is the function of a Message Relay?:correct answer: To enable all | | | | | | | | | | |
devices to commu-nicate all policy and reporting data using a dedicated server on
| | | | | | | | | | | | |
your network
| |
25. True or False:correct answer:Marking an alert as acknowledge will resolve
| | | | | | | | | |
the threat onthe endpoint.:correct answer: FALSE
| | | | | |
26. WhichTCP port is used to communicate Updates on endpoints?:correct | | | | | | | | |
answer: 8191
| |
27. TRUEor FALSE:correct answer:The securityVMinstaller islinked toyour | | | | | | | | | |
Sophos Centralaccount.:correct answer: FALSE
| | | |
28. TRUE or FALSE:correct answer:You can deploy an update cache without a | | | | | | | | | |
MessageRelay.:correct answer: TRUE
| | |
29. You want to change an action for 'confidential' content.Where in Sophos
| | | | | | | | | | |
Central do you make this change?:correct answer:In the Data Loss Prevention Rule
| | | | | | | | | | | | |
30. WhatdoesHIPSdoonaprotectedendpoint?:correct answer: Scansfor | | | | | | | | | |
potentiallymaliciousbehaviour
| |
31. You have cloned the threat protection base policy, applied the policy to a
| | | | | | | | | | | |
group and saved it.When checking the endpoint, the policy changes have nottaken
| | | | | | | | | | | |
effect.What do you check in the policy?:correct answer: That the cloned policy has
| | | | | | | | | | | | | |
beenenforced
|
32. In which 2 ways can you license the Enterprise Dashboard?:correct answer:
| | | | | | | | | |
(1) MasterLicensing
(2) Individual Licensing |
33. Whatis theminimumadministrativerolethatwillallowa userto createandedit| | | | | | | | | | | | |
policies?:correct answer: Admin
| | |
34. Complete the following sentence:correct answer:The default protection base | | | | | | | |
policy isconfigured with...:correct answer: Sophos' recommended settings
| | | | | | |
35. WhichsectionintheSelf-Helptoolshouldbecheckedtostartinvestigatingan | | | | | | | | | | |
updating issue on an endpoint:correct answer: System
| | | | | | |
2 |/ |6
