Sophos Certified Engineer Practice Exam

If tamper protection is enabled, what must be done before removing Endpoint Protection?

1. Send a notification to all users

2. Disabling tamper protection

3. Resetting the device

4. Running a full system diagnostic

The correct answer is: Disabling tamper protection

Removing Endpoint Protection with tamper protection enabled requires disabling the tamper protection feature first. This security measure is designed to prevent unauthorized changes to the software, including uninstallation. When tamper protection is active, it ensures that only authorized users or processes can modify or remove the Endpoint Protection software. Disabling tamper protection is an intentional process that aligns with standard security protocols, allowing for safe and authorized changes to be made. Once tamper protection is turned off, the software can be uninstalled or changed without any interference. This protects the integrity of the system while allowing for legitimate administrative actions, such as updates or removal of the software. Other options, while they may seem relevant for managing software or user notifications, do not directly address the primary requirement of disabling tamper protection before removal. Sending a notification, resetting the device, or running system diagnostics does not fulfill the necessary step to ensure tamper protection does not block the uninstallation process.