SOPHOS TECHNICIAN EXAM QUESTIONS AND ANSWERS LATEST UPDATE 2025 GRADED A+
Read - Answers What permissions does the user need to connect to AD to gather the user and group
information?
True - Answers TRUE or FALSE: Only PE files can be restored from SafeStore through the user interface.
Domain user - Answers What is the minimum type of user required to connect to AD to gather the user
and group information?
Global settings > Controlled Updates - Answers By default, computers get the latest Sophos product
updates automatically, where can an admin change this to allow control over updates?
telnet dc.sophos.local 636 - Answers You want to test the default SSL LDAP port for Active Directory
synchronization. Enter the command you would use to verify connectivity to a domain controller named
dc.sophos.local. _____
%ProgramData%\sophos\sophos cloud AD sync\logs - Answers Where is the AD sync log location?
nslookup - Answers The Central Admin Dashboard shows that none of your endpoints are using one of
your update caches. When pinging the update cache by name it fails. What command do you use to
investigate this further?
True - Answers TRUE or FALSE: Tamper Protection is enabled by default in Sophos Central.
(1) Sophos Endpoint Self Help
(2) Sophos Central - Answers Which 2 methods does Sophos provide that will display the status of all
Sophos services on Windows computers? Choose two (2).
The connection was blocked but the root cause has NOT been cleaned up - Answers Which of the
following statements is TRUE for a C2/Generic-C detection?
Active Directory Sync Utility - Answers Where do you check to see if the AD sync schedule has been
configured correctly?
Global Settings - Answers Where can the AD Sync tool be obtained from?
To detect man-in-the-middle attacks - Answers What is the function of Safe Browsing in Intercept X?
(1) Program Data\Sophos\SafeStore
(2) Program Data\Sophos\Sophos Anti-Virus\SafeStore - Answers Where can you find the SafeStore
quarantine folders on a Windows Endpoint? Choose two (2).
Resolve and verify - Answers What is the third step of the troubleshooting process?
(1) The threat was found in an archive
, (2) The threat was found in a mailbox - Answers Which 2 of the following are reasons why manual
cleanup may be required? Choose two (2).
True - Answers TRUE or FALSE: You can recover the Tamper Protection password for a deleted endpoint
in Sophos Central.
True - Answers TRUE or FALSE: Sophos recommends disabling HTTPS inspection for Sophos updating
traffic.
389 - Answers AD Sync is not working, you have successfully pinged the DC by both name and IP
address. Which port do you use with telnet to confirm the LDAP port is accessible?
C:\ProgramData\Sophos\AutoUpdate\data\warehouse - Answers What is the location of AutoUpdate's
warehouse on a protected endpoint?
(1) Germany
(2) United States
(3) Ireland - Answers When setting up a new Sophos Central account, which 3 of the following are the
datacentre locations you may select? Choose three (3).
(1) Ability to disable Tamper Protection
(2) Administrative rights to the network and AD
(3) Administrative rights to the endpoint - Answers Which 3 of the following are required to perform
troubleshooting on an endpoint? Choose three (3).
Use settings > website management to override the category for the website URL to one which is not
blocked - Answers Web Control has been configured to block access to a category, but this is preventing
access to a desired location. Which of the following methods can be used to allow access to this site
without allowing access to other sites in the same category?
%ProgramData%\Sophos\CloudInstaller\Logs - Answers Where is the
'SophosCloudInstaller_<time_and_date_stamp>.log' found?
False - Answers TRUE or FALSE: The default Update Cache TCP port of 8191 can be modified.
nslookup - Answers Which of the following Windows tools do you use to resolve IP addresses to
hostnames and hostnames to IP addresses?
ping - Answers Which of the following Windows tools do you use to test IP network connectivity?
netsh winhttp show proxy - Answers Enter the command you would use to display the current
configuration of the system proxy. _____
Read - Answers What permissions does the user need to connect to AD to gather the user and group
information?
True - Answers TRUE or FALSE: Only PE files can be restored from SafeStore through the user interface.
Domain user - Answers What is the minimum type of user required to connect to AD to gather the user
and group information?
Global settings > Controlled Updates - Answers By default, computers get the latest Sophos product
updates automatically, where can an admin change this to allow control over updates?
telnet dc.sophos.local 636 - Answers You want to test the default SSL LDAP port for Active Directory
synchronization. Enter the command you would use to verify connectivity to a domain controller named
dc.sophos.local. _____
%ProgramData%\sophos\sophos cloud AD sync\logs - Answers Where is the AD sync log location?
nslookup - Answers The Central Admin Dashboard shows that none of your endpoints are using one of
your update caches. When pinging the update cache by name it fails. What command do you use to
investigate this further?
True - Answers TRUE or FALSE: Tamper Protection is enabled by default in Sophos Central.
(1) Sophos Endpoint Self Help
(2) Sophos Central - Answers Which 2 methods does Sophos provide that will display the status of all
Sophos services on Windows computers? Choose two (2).
The connection was blocked but the root cause has NOT been cleaned up - Answers Which of the
following statements is TRUE for a C2/Generic-C detection?
Active Directory Sync Utility - Answers Where do you check to see if the AD sync schedule has been
configured correctly?
Global Settings - Answers Where can the AD Sync tool be obtained from?
To detect man-in-the-middle attacks - Answers What is the function of Safe Browsing in Intercept X?
(1) Program Data\Sophos\SafeStore
(2) Program Data\Sophos\Sophos Anti-Virus\SafeStore - Answers Where can you find the SafeStore
quarantine folders on a Windows Endpoint? Choose two (2).
Resolve and verify - Answers What is the third step of the troubleshooting process?
(1) The threat was found in an archive
, (2) The threat was found in a mailbox - Answers Which 2 of the following are reasons why manual
cleanup may be required? Choose two (2).
True - Answers TRUE or FALSE: You can recover the Tamper Protection password for a deleted endpoint
in Sophos Central.
True - Answers TRUE or FALSE: Sophos recommends disabling HTTPS inspection for Sophos updating
traffic.
389 - Answers AD Sync is not working, you have successfully pinged the DC by both name and IP
address. Which port do you use with telnet to confirm the LDAP port is accessible?
C:\ProgramData\Sophos\AutoUpdate\data\warehouse - Answers What is the location of AutoUpdate's
warehouse on a protected endpoint?
(1) Germany
(2) United States
(3) Ireland - Answers When setting up a new Sophos Central account, which 3 of the following are the
datacentre locations you may select? Choose three (3).
(1) Ability to disable Tamper Protection
(2) Administrative rights to the network and AD
(3) Administrative rights to the endpoint - Answers Which 3 of the following are required to perform
troubleshooting on an endpoint? Choose three (3).
Use settings > website management to override the category for the website URL to one which is not
blocked - Answers Web Control has been configured to block access to a category, but this is preventing
access to a desired location. Which of the following methods can be used to allow access to this site
without allowing access to other sites in the same category?
%ProgramData%\Sophos\CloudInstaller\Logs - Answers Where is the
'SophosCloudInstaller_<time_and_date_stamp>.log' found?
False - Answers TRUE or FALSE: The default Update Cache TCP port of 8191 can be modified.
nslookup - Answers Which of the following Windows tools do you use to resolve IP addresses to
hostnames and hostnames to IP addresses?
ping - Answers Which of the following Windows tools do you use to test IP network connectivity?
netsh winhttp show proxy - Answers Enter the command you would use to display the current
configuration of the system proxy. _____
