SOPHOS CERTIFIED ENGINEER EXAM
Which TCP port is used to communicate policies to endpoints? - answer8190
Which Sophos Central manage product protects the data on a lost or stolen laptop? -
answerEncryption
The option to stop the AutoUpdate service is greyed out in Windows Services. What is
the most likely reason for this? - answerTamper Protection is enabled
Complete the sentence: Signature-based file scanning relies on... - answerpreviously
detected malware characteristics
TRUE or FALSE: Tamper protection is enabled by default. - answerTRUE
You are unable to edit policies in Sophos Central. What do you check in Sophos
Central? - answerThat you have the correct role assigned
Which URL address do you use to login to Sophos Central Partner Dashboard? -
answerpartnerportal.sophos.com
You are detecting low-reputation files and want to change the reputation level from
recommended to strict. Which policy do you edit to make this change? - answerThreat
Protection
What is the FIRST step you must take when deploying virtual environments? -
answerCheck the system requirements
You want to prevent users from copying database files to USB drives without blocking
the use of all USB devices. Which policy do you need to configure? - answerData Loss
Prevention
TRUE or FALSE: You can search for a malicious item across your network using EDR -
answerTRUE
Which log provides a record of all activities? - answerAudit log
What is the function of anti-exploit technology? - answerTo detect and stop
compromised vulnerable applications
Complete the sentence: The SAV32CLI clean-up tool is a... - answerCommand line tool
included in Sophos Central installation
, When registering for a Sophos Central Trial, which of the following statements are
TRUE? - answerYou must use an email address that has not been used with Sophos
Central before
Which tab on the device details page displays the tamper protection information? -
answerSUMMARY
What is the function of Live Protection? - answerConnects to a cloud server to check for
the latest information about a file
How long are activities stored for in the Enterprise Dashboard? - answer90 days
What is the function of an Update Cache? - answerTo download updates from Sophos
Central and store them on a dedicated server on your network
What is the function of on-access scanning? - answerMonitors running processes'
behavior
Which of the following alerts is categorized as a high alert? - answerFailed to protect an
endpoint
Which dashboard allows you to manage and apply global settings to multiple Sophos
Central accounts? - answerThe Partner Dashboard
Which detection feature can prevent attacks on the master boot record? -
answerWipeGuard
What is the function of a Message Relay? - answerTo enable all devices to
communicate all policy and reporting data using a dedicated server on your network
True or False: Marking an alert as acknowledge will resolve the threat on the endpoint. -
answerFALSE
Which TCP port is used to communicate Updates on endpoints? - answer8191
TRUE or FALSE: The security VM installer is linked to your Sophos Central account. -
answerFALSE
TRUE or FALSE: You can deploy an update cache without a Message Relay. -
answerTRUE
You want to change an action for 'confidential' content. Where in Sophos Central do you
make this change? - answerIn the Data Loss Prevention Rule
What does HIPS do on a protected endpoint? - answerScans for potentially malicious
behaviour
Which TCP port is used to communicate policies to endpoints? - answer8190
Which Sophos Central manage product protects the data on a lost or stolen laptop? -
answerEncryption
The option to stop the AutoUpdate service is greyed out in Windows Services. What is
the most likely reason for this? - answerTamper Protection is enabled
Complete the sentence: Signature-based file scanning relies on... - answerpreviously
detected malware characteristics
TRUE or FALSE: Tamper protection is enabled by default. - answerTRUE
You are unable to edit policies in Sophos Central. What do you check in Sophos
Central? - answerThat you have the correct role assigned
Which URL address do you use to login to Sophos Central Partner Dashboard? -
answerpartnerportal.sophos.com
You are detecting low-reputation files and want to change the reputation level from
recommended to strict. Which policy do you edit to make this change? - answerThreat
Protection
What is the FIRST step you must take when deploying virtual environments? -
answerCheck the system requirements
You want to prevent users from copying database files to USB drives without blocking
the use of all USB devices. Which policy do you need to configure? - answerData Loss
Prevention
TRUE or FALSE: You can search for a malicious item across your network using EDR -
answerTRUE
Which log provides a record of all activities? - answerAudit log
What is the function of anti-exploit technology? - answerTo detect and stop
compromised vulnerable applications
Complete the sentence: The SAV32CLI clean-up tool is a... - answerCommand line tool
included in Sophos Central installation
, When registering for a Sophos Central Trial, which of the following statements are
TRUE? - answerYou must use an email address that has not been used with Sophos
Central before
Which tab on the device details page displays the tamper protection information? -
answerSUMMARY
What is the function of Live Protection? - answerConnects to a cloud server to check for
the latest information about a file
How long are activities stored for in the Enterprise Dashboard? - answer90 days
What is the function of an Update Cache? - answerTo download updates from Sophos
Central and store them on a dedicated server on your network
What is the function of on-access scanning? - answerMonitors running processes'
behavior
Which of the following alerts is categorized as a high alert? - answerFailed to protect an
endpoint
Which dashboard allows you to manage and apply global settings to multiple Sophos
Central accounts? - answerThe Partner Dashboard
Which detection feature can prevent attacks on the master boot record? -
answerWipeGuard
What is the function of a Message Relay? - answerTo enable all devices to
communicate all policy and reporting data using a dedicated server on your network
True or False: Marking an alert as acknowledge will resolve the threat on the endpoint. -
answerFALSE
Which TCP port is used to communicate Updates on endpoints? - answer8191
TRUE or FALSE: The security VM installer is linked to your Sophos Central account. -
answerFALSE
TRUE or FALSE: You can deploy an update cache without a Message Relay. -
answerTRUE
You want to change an action for 'confidential' content. Where in Sophos Central do you
make this change? - answerIn the Data Loss Prevention Rule
What does HIPS do on a protected endpoint? - answerScans for potentially malicious
behaviour
