Sophos Technician Exam Questions and Correct
Answers.
Global Settings
Where can the AD Sync tool be obtained from?
The connection was blocked but the root cause has NOT been cleaned up
Which of the following statements is TRUE for a C2/Generic-C detection?
Update > Update configuration
Where in the Endpoint Self Help Tool will show if an endpoint is using a proxy for updating?
DC=SOPHOS,DC=LOCAL
When configuring AD synchronization, what location was defined by default in filters under the User
Discovery Filters tab?
ping 172.16.2.20
Enter the command you would use to test IP network connectivity to the address 172.16.2.20. _____
Tamper Protection
Which feature would protect the Sophos installation from becoming disabled by malware?
389
AD Sync is not working, you have successfully pinged the DC by both name and IP address. Which port
do you use with telnet to confirm the LDAP port is accessible?
netsh winhttp reset proxy
Enter the command you would use to remove the currently configured system proxy.
%ProgramData%\Sophos\CloudInstaller\Logs
Where is the 'SophosCloudInstaller_<time_and_date_stamp>.log' found?
To prevent malicious behavior in software
What is the function of application lockdown in Intercept X?
Virus Removal tool
Which of these cleanup tools will scan for root kits?
Domain user
What is the minimum type of user required to connect to AD to gather the user and group information?
, True
TRUE or FALSE: Sophos recommends disabling HTTPS inspection for Sophos updating traffic.
Sophos Intercept X
On a Windows computer, which component logs information to the 'Sophos.log' file?
nslookup
The Central Admin Dashboard shows that none of your endpoints are using one of your update caches.
When pinging the update cache by name it fails. What command do you use to investigate this further?
Resolve and verify
What is the third step of the troubleshooting process?
Global settings > Controlled Updates
By default, computers get the latest Sophos product updates automatically, where can an admin change
this to allow control over updates?
SHA-256
The file paths
The certificate
In which 3 ways can you allow a quarantined file to be restored?
Windows client firewall blocking traffic
When investigating an updating issue on one of your endpoints, you used the telnet command to
connect to dci.sophosupd.com on port 443. This confirmed that there is a problem using a direct
connection. What is most likely to be causing this?
Ability to disable Tamper Protection
Administrative rights to the network and AD
Administrative rights to the endpoint
Which 3 of the following are required to perform troubleshooting on an endpoint? Choose three (3).
Read
What permissions does the user need to connect to AD to gather the user and group information?
60 mins
AutoUpdate performs its first check 5 minutes after the service starts. At what interval does AutoUpdate
then check for software, threat detection data and other available updates?
True
TRUE or FALSE: Only PE files can be restored from SafeStore through the user interface.
Answers.
Global Settings
Where can the AD Sync tool be obtained from?
The connection was blocked but the root cause has NOT been cleaned up
Which of the following statements is TRUE for a C2/Generic-C detection?
Update > Update configuration
Where in the Endpoint Self Help Tool will show if an endpoint is using a proxy for updating?
DC=SOPHOS,DC=LOCAL
When configuring AD synchronization, what location was defined by default in filters under the User
Discovery Filters tab?
ping 172.16.2.20
Enter the command you would use to test IP network connectivity to the address 172.16.2.20. _____
Tamper Protection
Which feature would protect the Sophos installation from becoming disabled by malware?
389
AD Sync is not working, you have successfully pinged the DC by both name and IP address. Which port
do you use with telnet to confirm the LDAP port is accessible?
netsh winhttp reset proxy
Enter the command you would use to remove the currently configured system proxy.
%ProgramData%\Sophos\CloudInstaller\Logs
Where is the 'SophosCloudInstaller_<time_and_date_stamp>.log' found?
To prevent malicious behavior in software
What is the function of application lockdown in Intercept X?
Virus Removal tool
Which of these cleanup tools will scan for root kits?
Domain user
What is the minimum type of user required to connect to AD to gather the user and group information?
, True
TRUE or FALSE: Sophos recommends disabling HTTPS inspection for Sophos updating traffic.
Sophos Intercept X
On a Windows computer, which component logs information to the 'Sophos.log' file?
nslookup
The Central Admin Dashboard shows that none of your endpoints are using one of your update caches.
When pinging the update cache by name it fails. What command do you use to investigate this further?
Resolve and verify
What is the third step of the troubleshooting process?
Global settings > Controlled Updates
By default, computers get the latest Sophos product updates automatically, where can an admin change
this to allow control over updates?
SHA-256
The file paths
The certificate
In which 3 ways can you allow a quarantined file to be restored?
Windows client firewall blocking traffic
When investigating an updating issue on one of your endpoints, you used the telnet command to
connect to dci.sophosupd.com on port 443. This confirmed that there is a problem using a direct
connection. What is most likely to be causing this?
Ability to disable Tamper Protection
Administrative rights to the network and AD
Administrative rights to the endpoint
Which 3 of the following are required to perform troubleshooting on an endpoint? Choose three (3).
Read
What permissions does the user need to connect to AD to gather the user and group information?
60 mins
AutoUpdate performs its first check 5 minutes after the service starts. At what interval does AutoUpdate
then check for software, threat detection data and other available updates?
True
TRUE or FALSE: Only PE files can be restored from SafeStore through the user interface.
