SOPHOS ENGINEER CERTIFICATION EXAM SCRIPT WITH SOLUTIONS 2026

SOPHOS ENGINEER CERTIFICATION EXAM
SCRIPT WITH SOLUTIONS 2026

◉ In which of the following circumstances would a scheduled scan
be required? Answer: scanning outside of working hours to
minimize disruptions to users


◉ Which of the following statements best describes peripheral
control? Answer: protect devices from potential malware on
removable drives


◉ Which report displays a list of all detected controlled
applications? Answer: events report


◉ When a server is locked down, what type of applications can be
run? Answer: known/trusted


◉ TRUE or FALSE: Base policies cannot be disabled. Answer: TRUE


◉ Which feature allows you to restrict applications that can run on a
protected server? Answer: server lockdown

, ◉ TRUE or FALSE: Deep learning relies on malware signatures.
Answer: FALSE


◉ You have cloned a Base Policy. How do you ensure the policy is
applied? Answer: enforce it


◉ TRUE or FALSE: Detected items are restored to their original
location if they are released from the Sophos SafeStore. Answer:
TRUE


◉ When are alerts created in Sophos Central? Answer: when action
is required


◉ Complete the sentence. Marking an alert as resolved... Answer:
...does not resolve the threat.


◉ TRUE or FALSE: When you mark an alert as resolved, Sophos
Central verifies that the threat to the endpoint or server has been
resolved. Answer: FALSE


◉ TRUE or FALSE: Sophos Central SafeStore encrypts all
quarantined items. Answer: TRUE


◉ How long, in months, do scheduled reports expire? Answer: 6