Sophos Certified Technician Practice Exam

These questions are part of the practice quiz. Start practicing

• How does Sophos track endpoint devices on a network?
• Which of the following statements is TRUE regarding a C2/Generic-C detection?
• What is the role of the Sophos Central Management platform?
• How does Sophos CASB enhance cloud security?
• Which command in the context of network configuration shows the existing proxy settings?
• What is the function of application lockdown in Intercept X?
• What does Sophos recommend for effective security management?
• True or False: AD Sync will delete groups and users with no Central Admin role when they are no longer present in the search results?
• How does Sophos Central help in managing endpoints?
• How does Sophos integrate with third-party security solutions?
• What does Sophos Managed Threat Response do?
• What security feature is used in Sophos Firewall to protect from DDoS attacks?
• At what interval does AutoUpdate check for software and updates after its initial check?
• TRUE or FALSE: Only PE files can be restored from SafeStore through the user interface?
• What is the benefit of using Sophos Synchronized Security?
• Where can you find information about whether an endpoint is using a proxy for updating?
• Which feature of Sophos provides protection against unauthorized access to data?
• The Central Admin Dashboard shows that none of your endpoints are using one of your update caches. What command do you use to investigate this?
• How can users enable Self-Service features in Sophos?
• Which of the following best describes the concept of compliance status reporting?
• Where is the AD sync log location?
• What is the value of deploying Endpoint Detection and Response (EDR) capabilities?
• What is the primary goal of incident response within the context of Sophos?
• Does Sophos recommend disabling HTTPS inspection for Sophos updating traffic?
• When setting up a new Sophos Central account, which of the following datacentre locations can you select? Choose three.
• What feature does Sophos provide to mitigate risks from unverified applications?
• What does Synchronized Security Lateral Movement Protection use to identify endpoints that have a red health status?
• What is the benefit of using Sophos Cloud Optix?
• Which Windows service must be disabled when recovering a tamper protected endpoint?
• Which two methods provided by Sophos display the status of all Sophos services on Windows computers?
• What does Sophos provide in response to security incidents?
• How can an organization monitor its network using Sophos?
• Which Windows tool is used to resolve IP addresses to hostnames and vice versa?
• What command is used to display the current configuration of the system proxy?
• Where is the 'SophosCloudInstaller_.log' file found?
• What output formats are supported by the SDR Exporter Tool?
• What port number does a Message Relay use?
• Which statement is true for API Credentials?
• What reporting features are essential for compliance management in Sophos?
• What command would you use to test the default SSL LDAP port for Active Directory synchronization?
• Which user access method is implemented by Sophos?
• What does policy validation in Sophos help to ensure?
• Which of the following statements correctly describes a Message Relay?
• Which of these is a critical step after modifying the Windows Registry?
• What feature allows Sophos to effectively identify and respond to data breaches?
• What type of updates does the Endpoint Self Help Tool manage?
• Which Sophos product is used for web filtering and security?
• How does Sophos detect advanced persistent threats (APTs)?
• Is it possible to recover the Tamper Protection password for a deleted endpoint in Sophos Central?
• Which of the following is not a part of the compliance reporting in Sophos?
• Can you deploy an update cache without a Message Relay?
• What permissions does a user need to connect to Active Directory to gather user and group information?
• Where can you find the option to check if an endpoint is using a proxy for updating in the Endpoint Self Help Tool?
• What does the AD Sync utility primarily focus on?
• What feature of Sophos Firewall helps in detecting unauthorized access?
• Which of the following statements about user permissions in Sophos Central is correct?
• What is a critical preventive measure for safeguarding the Sophos installation from malware threats?
• TRUE or FALSE: AD sync needs to be installed on a DC?
• Which installer runs the Competitor Removal Tool (CRT)?
• How many executions of SophosZap are required to complete removal of Sophos Endpoint?
• If a user needs to adjust the Tamper Protection settings, which option grants them access?
• What is the primary purpose of the Endpoint Self Help Tool?
• What is the first step before using SophosZap to uninstall Sophos Endpoint?
• You suspect an issue with your Update Cache. Which 2 logs do you need to examine? Choose two.
• Can you deploy a Message Relay without an Update Cache?
• What must be enforced to modify settings for scheduled scanning in a cloned threat protection base policy?
• Which of the following is a feature of Sophos Central?
• Which switch will prevent the installer from being displayed during a scripted deployment?
• What is a notable benefit of Sophos’ Sandbox technology?
• What is essential for the effectiveness of Sophos managed threat response?
• Which tool do you use to verify the Active Directory sync schedule?
• From which two locations can you run the Windows version of the Sophos Diagnostic Utility?
• What type of data is captured by Sophos' active threat response feature?
• Where is the 'install.log' file found on a Mac OS X endpoint?
• Which statement is true regarding a C2/Generic-A detection?
• What search criteria do you enter to identify an updating issue in the SophosUpdate.log?
• Can the default Update Cache TCP port of 8191 be modified?
• TRUE or FALSE: A single instance of AD Sync can synchronise from multiple domains in a forest?
• In terms of reporting, what does Sophos focus on to ensure operational compliance?
• Which tool can be used for analyzing network performance in Sophos?
• Which application can be used to disable Tamper Protection?
• Which of the following Windows tools do you use to display the route taken to reach a networking destination?
• From where can the Active Directory Sync tool be obtained?
• What is the primary purpose of Sophos Endpoint Protection?
• What additional instruction must you add to the command 'ipconfig' to clear the DNS cache?
• What are the two primary functions of Sophos Clean?
• What type of encryption does Sophos use to protect sensitive data in transit?
• Which feature protects the Sophos installation from being disabled by malware?
• Which switch can be used with SophosSetup.exe to point to the name and location of a custom catalog file?
• What is one of the primary functions of the Virus Removal Tool?
• What is the common reason for using telnet to troubleshoot AD Sync?
• What does PUA stand for in the context of cybersecurity?
• What feature protects Sophos processes and settings from unauthorized changes?
• What two actions would allow a single user to change protection settings on their endpoint?
• What types of malware does Sophos Antivirus primarily protect against?
• What does the acronym MCS stand for in the context of the Sophos Agent Service?
• What is a major benefit of using audit logs in Sophos?
• Which component is crucial for diagnosing issues with an endpoint?
• In a Windows computer, which component is responsible for logging details into the 'Sophos.log' file?
• What does the Virus Removal Tool focus on?
• Why might the status 'Last time updated from cache' show as 'in a year'?
• If the Windows Firewall service is not active during Update Cache deployment, what needs to be done to resolve the issue?
• What should you do to disable the new Threat Protection policy you added for testing?
• What kind of reports can be generated through Sophos Central?
• What log would you check to confirm that the endpoint is able to reach the update cache during a failed update investigation?
• Which cleanup tool is specifically designed to scan for root kits?
• What are some key notable features of Sophos Central?
• Before bulk deploying Sophos Central using a startup script in GPO, what is the necessary step?
• Which additional instruction must be added to the command 'ipconfig' to display the contents of the DNS cache?
• What is the purpose of Sophos’ Advanced Threat Protection?
• Which Windows tool is used to test connectivity to a specific port or service?
• How do you implement Sophos updates on endpoints?
• To confirm the LDAP port when AD Sync is not working, which port should you use with telnet?
• What is the minimum type of user required to connect to Active Directory to gather user and group information?
• Which statement is TRUE about alerts in Sophos?
• Which of the following can indicate a potential malware infection?
• Why is it essential to apply updates and patches across a network?
• Which Sophos product provides real-time antivirus protection?
• What kind of updates does Sophos provide to prevent new threats?
• What functionality does Sophos’ mobile security offer?
• What key aspect does Sophos’ Advanced Threat Protection utilize for threat detection?
• Where is automatic self-isolation enabled in Sophos?
• How does Sophos address insider threats?
• Can all the default policies in Sophos Central be disabled?
• What command resolves the IP address of srv.sophos.local and shows the DNS server providing the resolution?
• What is the role of endpoint detection and response (EDR) in malware protection?
• When investigating an updating issue on your endpoint, if telnet to dci.sophosupd.com on port 443 shows a problem, what is most likely causing this?
• How can the Competitor Removal Tool be modified to remove software that has not been detected?
• What feature allows Sophos Endpoint to rollback ransomware changes?
• What types of communication protocols can be secured by Sophos?
• Which of the following statements is TRUE for a C2/Generic-B detection?
• What information is typically configured in the Update section of the Endpoint Self Help Tool?
• Which portable executable (PE) files will be returned when a threat search is launched?
• Is all quarantined data encrypted in SafeStore?
• What is the primary function of CryptoGuard?
• Which Sophos technology provides visibility over encrypted traffic?
• Is it possible for users to override self-isolation through Sophos Endpoint?
• Which type of files does Sophos Antivirus scan by default?
• What is the main benefit of selecting a data center close to your location when setting up Sophos Central?
• Which of the following Windows tools do you use to test IP network connectivity?
• What should you do if your endpoint is not updating correctly?
• Which tool is primarily used by Sophos for monitoring endpoint devices?
• What challenges does Sophos Endpoint Detection and Response (EDR) address?
• How does Sophos manage endpoint compliance?
• In which three ways can you allow a quarantined file to be restored?
• What is the function of Safe Browsing in Intercept X?
• What is the role of the Sophos Security Heartbeat?
• What encryption standard does Sophos Full Disk Encryption use?
• What action should be taken if Sophos detects unresolved connections?
• How does Sophos act upon detected vulnerabilities in systems?
• What is the main purpose of logging features in Sophos Firewall?
• How does Sophos Intercept X enhance endpoint security?
• What key aspect does Sophos emphasize in its endpoint monitoring?
• What information does the Sophos Diagnostic Utility provide?
• How frequently should compliance reports be reviewed to maintain effectiveness in Sophos?
• What type of credentials are required for AD Sync in Sophos Central?
• True or False: The Sophos Diagnostic Utility is available for Windows endpoints only.
• When configuring Active Directory synchronization, what location is defined by default in filters under the User Discovery Filters tab?
• You wish to uninstall Sophos Endpoint software from a Windows 10 computer, but Tamper Protection is enabled. Which two methods are supported for removal?
• What protocols does Sophos XG Firewall support for VPN services?
• Where can you find detailed information about a specific threat?
• Which feature of Sophos is employed to protect against phishing attacks?
• Select which 2 of the following statements are TRUE about MCS?
• Which Windows tool would you use to display the network configuration?
• What is the second step of the troubleshooting process?
• What command is used to clear the DNS cache on a Windows machine?
• Which tool would you use to remove stubborn malware that is associated with rootkits?
• What is the purpose of the Central Dashboard in Sophos Central?
• Is Tamper Protection enabled by default in Sophos Central?
• What is the role of a Sophos Central policy?
• You have configured and run AD Sync. You notice a user that is present in AD is missing from Central. What is the first step in troubleshooting this issue?
• How does Sophos categorize user access and permissions?
• What is the significance of security policies in Sophos?
• What is the most likely reason the option to stop the AutoUpdate service is greyed out in Windows Services?
• What is the role of Sophos' Anti-Ransomware technology?
• What role does managed threat response play in Sophos solutions?
• What is the recommended policy setting for endpoint protection?
• In case of a failed software update, what is one potential cause to investigate?
• What value data should be entered in the Windows Registry to disable the Sophos MCS Agent Service?
• Which command is used to set the boot mode to safe boot with network on Windows?
• What benefits does data encryption offer in Sophos solutions?
• Which tool helps in managing threat cases within Sophos?
• What can a server policy for Threat Protection in Sophos Central be assigned to?
• Enter the additional instruction that must be added to the command 'ipconfig' to view all IP settings for a computer:
• In which two places can you create a forensic snapshot?
• What are the three actions available following a threat search?
• Why is it essential to regularly update Sophos components?
• What alerts may indicate a compromised endpoint in Sophos?
• What type of traffic is allowed when an endpoint is in self isolation mode?
• Which Sophos product is designed to block unwanted applications?
• What is the primary function of a Message Relay in a network?
• When troubleshooting, which step follows verifying the problem?
• What is the term for an attack that uses techniques that anti-virus does not yet detect?
• What is a potential consequence of disabling Tamper Protection?
• How frequently should Sophos systems be configured for optimal performance?
• What is the first step of the troubleshooting process?
• What command is entered to run SophosZap?
• What is the role of a quarantine in data security?
• True or False: Sophos recommends disabling HTTPS inspection for MCS traffic.
• What is the primary function of Sophos Email Gateway?
• Which Sophos product is specifically designed for email protection?
• How does Sophos’ Phish Threat feature help organizations?
• What can be monitored via the Sophos Central API?
• What is the purpose of device control in security settings?
• What capability does improved endpoint detection and response (EDR) provide?
• How would you test IP network connectivity to the address 172.16.2.20?
• What does the error 'copy from upstream failed: Cannot write resource' typically indicate?
• What action can be taken to allow access to a desired site that is blocked by Web Control without allowing access to all sites in the same category?
• If an installation of Sophos Central failed on a Windows computer, which log file should you refer to first?
• What is a key function of Sophos XG Firewall?
• What is the primary function of the Sophos Update Cache?
• In which scenario would you most likely use the 'Diagnose' feature in Sophos?
• Where can you find SafeStore quarantine folders on a Windows Endpoint? Choose two.
• What is often an outcome of effective incident response in Sophos?
• What is the primary function of Sophos' Endpoint Protection client?
• By default, computers get the latest Sophos product updates automatically, where can an admin change this to allow control over updates?
• How often should security policies be reviewed in Sophos?
• What is the primary function of the nslookup tool?
• Which three are required to perform troubleshooting on an endpoint?
• What is the third step of the troubleshooting process?
• When clearing the local AutoUpdate cache, which two folders need to be renamed?
• What is a common symptom of rootkit infections?
• How long can you override the Sophos Central policy when troubleshooting an endpoint?
• What command is used to remove the currently configured system proxy?
• Which technologies are integrated into Sophos Intercept X to stop malware?
• Which command would you use to check the current IP configuration on a Windows machine?
• What does Sophos’ web filtering feature block?
• Should C:\TEMP ever be whitelisted in Sophos Central?
• What is a primary function of the Sophos Central API?
• What does Sophos’ Web Filtering allow administrators to do?
• Where is the location of AutoUpdate's warehouse on a protected endpoint?
• When would it be necessary to perform manual cleanup on a detected threat?
• Which command tests a connection to srv.sophos.local on TCP port 8191?
• What command would you use to resolve the IP address of srv.sophos.local and test connectivity simultaneously?
• What role does activity reporting play in Sophos compliance management?
• Why is selecting a datacentre location important when setting up accounts?
• What type of logs does Sophos maintain to assist with compliance?