Sophos Technician latest updated exam with 100% accurate rationales

Global Settings

Where can the AD Sync tool be obtained from?

The connection was blocked but the root cause has NOT been cleaned up

Which of the following statements is TRUE for a C2/Generic-C detection?

Update > Update configuration

Where in the Endpoint Self Help Tool will show if an endpoint is using a proxy for updating?

DC=SOPHOS,DC=LOCAL

When configuring AD synchronization, what location was defined by default in filters under the User Discovery Filters tab?

ping 172.16.2.20

Enter the command you would use to test IP network connectivity to the address 172.16.2.20. _____

Tamper Protection

Which feature would protect the Sophos installation from becoming disabled by malware?

389

AD Sync is not working, you have successfully pinged the DC by both name and IP address. Which port do you use with telnet to confirm the LDAP port is accessible?

netsh winhttp reset proxy

Enter the command you would use to remove the currently configured system proxy.

%ProgramData%\Sophos\CloudInstaller\Logs

Where is the 'SophosCloudInstaller_.log' found?

To prevent malicious behavior in software

What is the function of application lockdown in Intercept X?

Virus Removal tool

Which of these cleanup tools will scan for root kits?

Domain user

What is the minimum type of user required to connect to AD to gather the user and group information?

True

TRUE or FALSE: Sophos recommends disabling HTTPS inspection for Sophos updating traffic.

Sophos Intercept X

On a Windows computer, which component logs information to the 'Sophos.log' file?

nslookup

The Central Admin Dashboard shows that none of your endpoints are using one of your update caches. When pinging the update cache by name it fails. What command do you use to investigate this further?

Resolve and verify

What is the third step of the troubleshooting process?

Global settings > Controlled Updates

By default, computers get the latest Sophos product updates automatically, where can an admin change this to allow control over updates?

SHA-256

The file paths

The certificate

In which 3 ways can you allow a quarantined file to be restored?

Windows client firewall blocking traffic

When investigating an updating issue on one of your endpoints, you used the telnet command to connect to dci.sophosupd.com on port 443. This confirmed that there is a problem using a direct connection. What is most likely to be causing this?

Ability to disable Tamper Protection

Administrative rights to the network and AD

Administrative rights to the endpoint

Which 3 of the following are required to perform troubleshooting on an endpoint? Choose three (3).

Read

What permissions does the user need to connect to AD to gather the user and group information?

60 mins

AutoUpdate performs its first check 5 minutes after the service starts. At what interval does AutoUpdate then check for software, threat detection data and other available updates?

True

TRUE or FALSE: Only PE files can be restored from SafeStore through the user interface.

Enter the command you would use to resolve the IP address of srv.sophos.local and test network connectivity to the server at the same time. _____

Date and time are incorrect on the Update Cache server

Why would the 'Last time updated from cache' status show as 'in a year'?

The threat was found in an archive

The threat was found in a mailbox

Which 2 of the following are reasons why manual cleanup may be required? Choose two (2).

%ProgramData%\sophos\sophos cloud AD sync\logs

Where is the AD sync log location?

False

TRUE or FALSE: The default Update Cache TCP port of 8191 can be modified.

True

TRUE or FALSE: Tamper Protection is enabled by default in Sophos Central.

An unknown file

An executable file in a temporary file location

Which 2 of the following are malicious file indicators? Choose two (2).

From the device page

From a threat case

In which 2 places can you create a forensic snapshot?

True

TRUE or FALSE: You can recover the Tamper Protection password for a deleted endpoint in Sophos Central.

The Update Cache server has run out of disc space

You see the following error in the SophosUpdate.log:WARN [WARN] copy from upstream failed: Cannot write resource: C:/Programdata/sophos/autoupdate/data/warehouse/9548-885What could this indicate?

Use settings > website management to override the category for the website URL to one which is not blocked

Web Control has been configured to block access to a category, but this is preventing access to a desired location. Which of the following methods can be used to allow access to this site without allowing access to other sites in the same category?

Program Data\Sophos\SafeStore

Program Data\Sophos\Sophos Anti-Virus\SafeStore

Where can you find the SafeStore quarantine folders on a Windows Endpoint? Choose two (2).

True

TRUE or FALSE: C:\TEMP should never be whitelisted in Sophos Central.

To remove malware and PUA's

To move all detected items to SafeStore

What are the 2 primary functions of Sophos Clean? Choose two (2).

True

TRUE or FALSE: All quarantined data is encrypted in SafeStore.

True

TRUE or FALSE: A single instance of AD Sync can synchronise from multiple domains in a forest?

True

TRUE or FALSE: You can deploy an update cache without a Message Relay.

Ping

Which of the following Windows tools do you use to test IP network connectivity?

To protect against vulnerabilities in software

Why is it important to apply updates and patches to all applications and operating systems across your network?

The Threat Library

Where can you find more information about a specific threat?

Alerts are created when an action is required

Which of the following statements is TRUE about alerts?

decoded

warehouse

When clearing the local AutoUpdate cache prior to forcing an update, which 2 of the following folders do you need to rename? Choose two

False

TRUE or FALSE: AD sync needs to be installed on a DC?

Sophos Endpoint Self Help

Sophos Central

Which 2 methods does Sophos provide that will display the status of all Sophos services on Windows computers? Choose two (2).

Root Cause Analysis

What is the second step of the troubleshooting process?

netsh winhttp show proxy

Enter the command you would use to display the current configuration of the system proxy. _____

Sophos Anti-Virus

Which installer runs the Competitor Removal Tool (CRT)?

ipconfig /flushdns

What command can be used to clear the DNS cache?

Germany

United States

Ireland

When setting up a new Sophos Central account, which 3 of the following are the datacentre locations you may select? Choose three (3).

The connection was NOT blocked and the threat has NOT been cleaned up

Which of the following statements is TRUE for a C2/Generic-B detection?

Enter the command you would use to resolve the IP address of srv.sophos.local and show the DNS server providing the resolution._____

SophosCloudInstaller_.log

If an installation of Sophos Central failed on a Windows computer, which log file would you refer to first to help diagnose the problem?

C:\ProgramData\Sophos\AutoUpdate\data\warehouse

What is the location of AutoUpdate's warehouse on a protected endpoint?

True

TRUE or FALSE: AD Sync will delete groups and users with no Central Admin role when they are no longer present in the search results?

Test the deployment script

What step do you need to take before you bulk deploy Sophos Central to endpoints using a startup script in GPO?

Boot into Safe Mode and disable Tamper Protection via the Registry

Retrieve the password for the deleted endpoint within Central so you can then enter this within the local Endpoint UI

You wish to uninstall the Sophos Endpoint software from a Windows 10 computer. However, Tamper Protection is enabled, and the device is no longer present within Central Admin. Which 2 of following are supported methods of removal? Choose two (2).

Define the issue

What is the first step of the troubleshooting process?

Active Directory Sync Utility

Where do you check to see if the AD sync schedule has been configured correctly?

ipconfig

Which of the following Windows tools do you use to display the network configuration?

nslookup

Which of the following Windows tools do you use to resolve IP addresses to hostnames and hostnames to IP addresses?

--quiet

Which switch will prevent the installer from being displayed during a scripted deployment?

Tamper Protection is enabled

The option to stop the AutoUpdate service is greyed out in Windows Services. What is the most likely reason for this?

To detect malicious file encryption by ransomware

What is the function of CryptoGuard?

In the Threat Protection policy

Where is automatic self-isolation enabled?

You suspect an issue with you Update Cache. Which 2 logs do you need to examine? Choose two (2).

You want to test the default SSL LDAP port for Active Directory synchronization. Enter the command you would use to verify connectivity to a domain controller named dc.sophos.local. _____

zero-day threats

What is the term for an attack that uses techniques that anti-virus does not yet detect?

4 hours

When troubleshooting an endpoint, how long can you override the Sophos Central policy for?

Restart the update cache service

If the Windows Firewall service is stopped or disabled when the Update Cache is deployed, then the firewall rule to allow TCP 8191 will not have been created. How do you resolve this?

To detect man-in-the-middle attacks

What is the function of Safe Browsing in Intercept X?

/private/var/log

Where is the 'install.log' found on a Mac OS X endpoint?