100+ Free Sophos XDR Architect Practice Questions
Pass your Sophos Certified Architect — Sophos Central XDR / MDR (AT12) exam on the first try — instant access, no signup required.
Which Sophos product/endpoint exposes alerts and SIEM-style events for shipping into Splunk, Microsoft Sentinel, or QRadar?
Explore More Sophos Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
Key Facts: Sophos XDR Architect Exam
60
Exam Questions
Sophos AT12
90 min
Time Limit
Online proctored
80%
Passing Score
Sophos AT12
Free
Exam Fee
With course / partner enablement
90 days
Data Lake Retention
Standard (1-year extended add-on available)
AT12
Sophos Code
ET12 Engineer prerequisite
The Sophos Certified Architect — Sophos Central XDR / MDR (AT12) is an architect-tier exam with 60 multiple-choice questions in 90 minutes and an 80% passing score, delivered free with course/partner enablement through the Sophos Training Portal (NetExam). It tests multi-tenant deployment with Sophos Central Enterprise sub-estates and Partner, Data Lake design (90-day default, 1-year extended retention add-on), custom Live Discover queries on OSquery and Sophos schemas with never-reused Sophos PIDs, hypothesis-driven hunting using the PEAK framework and MITRE ATT&CK Navigator, detection engineering with a measurable lifecycle, advanced incident response and forensics including Threat Cases and Live Response, OAuth 2.0 API automation (X-Tenant-ID, 1-hour tokens, 429 backoff) for SIEM (Splunk, Microsoft Sentinel, QRadar) and SOAR (Cortex XSOAR, Splunk SOAR) integration, and MDR Essentials vs MDR Complete operations with the contractual 60-minute high-severity SLA and $1M Breach Protection Warranty. ET12 Engineer is the recommended prerequisite.
Sample Sophos XDR Architect Practice Questions
Try these sample questions to test your Sophos XDR Architect exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.
1An MSP partner needs to manage the security of 40 customer organizations from a single pane of glass while letting each customer keep its own admin team and policies. Which Sophos Central deployment model is the BEST fit?
2An organization with 12 regional sites wants each region to have its own admins and policies but the head office to keep visibility into all regions. Which Sophos Central feature satisfies this requirement?
3What is the default Data Lake retention period for endpoint and server data in Sophos Central XDR (without an extended-retention add-on)?
4A SOC architect needs hunters to be able to look back 9 months when investigating a slow-moving APT. Which design change is required on Sophos Central XDR?
5Which Sophos product family contributes Data Lake telemetry that hunters can correlate alongside endpoint events through Live Discover?
6A customer has 8,000 endpoints distributed across three continents. Which Data Lake design fact most strongly influences the deployment architecture?
7Which Sophos Central policy must be enabled for endpoints and servers to upload data into the Data Lake for XDR queries?
8Which integration is REQUIRED to enable Synchronized Security between Intercept X endpoints and a Sophos Firewall in the same XDR deployment?
9A bank wants Sophos XDR to analyze East-West cloud traffic patterns across 60 AWS accounts and flag exposed S3 buckets. Which Sophos product MUST be integrated into Sophos Central to ingest that telemetry?
10An architect is planning XDR sensor coverage for a 10,000-seat estate with mixed Windows, macOS, and Linux servers. Which statement is TRUE about XDR sensor placement?
About the Sophos XDR Architect Exam
The Sophos Certified Architect — Sophos Central XDR / MDR (AT12) exam validates architect-level skills in deploying, hunting, and operating Sophos's XDR and MDR platforms at scale. It covers multi-tenant Sophos Central (Enterprise sub-estates and Partner), Sophos Data Lake design with 90-day default and 1-year extended retention, custom Live Discover queries against OSquery and Sophos schemas, MITRE ATT&CK and PEAK-driven hunting, detection engineering with Sigma-style translation and a measurable lifecycle, advanced incident response and forensics with Threat Cases and Live Response, Sophos Central OAuth 2.0 API automation with SIEM/SOAR integration, and MDR Essentials vs MDR Complete operations including onboarding, baselining, MTTD/MTTR metrics, and reporting cadence.
Assessment
60 multiple-choice questions covering XDR/MDR architecture and deployment, advanced threat hunting, detection engineering, incident response and forensics, integrations and automation, and MDR operations.
Time Limit
90 minutes
Passing Score
80%
Exam Fee
Free with course / partner enablement (Sophos / NetExam Training Portal)
Sophos XDR Architect Exam Content Outline
XDR/MDR Architecture & Deployment
Multi-tenant Sophos Central designs (Enterprise sub-estates and Partner), sensor placement at scale on Intercept X and Server Protection, Data Lake retention design (90-day default vs 1-year extended retention add-on), and cross-product integration with Sophos Firewall, Email, and Cloud Optix / Cloud Native Security.
Advanced Threat Hunting
Custom Live Discover queries against the OSquery + Sophos endpoint extension schema and the Data Lake schema, hypothesis-driven hunts using the PEAK methodology, MITRE ATT&CK Navigator coverage layers, and pivoting across endpoint, server, firewall, email, and cloud telemetry using never-reused Sophos PIDs.
Detection Engineering
Custom detection rules, Sigma-to-Sophos translation, Threat Indicators for IOCs, scoped suppression rules for false positives, query performance tuning, backtesting against historical Data Lake telemetry, and a precision/recall-driven detection lifecycle.
Incident Response & Forensics
Threat Cases with root-cause analysis graphs, advanced Live Response on Windows/macOS/Linux for memory captures and artifact collection, forensic timelines built from process and file journals, isolation containment that preserves the management channel, and lessons-learned with retro hunts.
Integrations & Automation
Sophos Central OAuth 2.0 client_credentials API with X-Tenant-ID and 1-hour Bearer tokens, the sophos-central-api-connector Python SDK, SIEM integration (Splunk, Microsoft Sentinel, IBM QRadar), SOAR playbooks (Cortex XSOAR, Splunk SOAR), webhook destinations with signature validation, and exponential-backoff handling of HTTP 429 throttling.
MDR Operations
MDR Essentials vs MDR Complete (contractual 60-minute SLA on 90% of high-severity cases, $1M Breach Protection Warranty), customer onboarding and baselining, escalation matrix, customer success metrics (MTTD, MTTR, dwell time), and MDR reporting cadence (real-time, monthly, QBR).
How to Pass the Sophos XDR Architect Exam
What You Need to Know
- Passing score: 80%
- Assessment: 60 multiple-choice questions covering XDR/MDR architecture and deployment, advanced threat hunting, detection engineering, incident response and forensics, integrations and automation, and MDR operations.
- Time limit: 90 minutes
- Exam fee: Free with course / partner enablement
Keys to Passing
- Complete 500+ practice questions
- Score 80%+ consistently before scheduling
- Focus on highest-weighted sections
- Use our AI tutor for tough concepts
Sophos XDR Architect Study Tips from Top Performers
Frequently Asked Questions
What is the Sophos AT12 (Sophos Certified Architect — Central XDR / MDR) exam?
AT12 is Sophos's architect-tier certification for designing and operating Sophos Central XDR and MDR at scale. It covers multi-tenant deployment with Enterprise sub-estates and Partner, Data Lake retention (90-day default and 1-year extended add-on), custom Live Discover queries across OSquery and Sophos schemas, hypothesis-driven hunting with PEAK and MITRE ATT&CK Navigator, detection engineering, advanced incident response with Threat Cases and Live Response, Sophos Central OAuth 2.0 API automation, SIEM/SOAR integration, and MDR Essentials vs MDR Complete operations.
How many questions are on AT12 and what is the passing score?
AT12 has 60 multiple-choice questions with a 90-minute time limit and an 80% passing score. The exam is delivered as an online proctored test through the Sophos Training Portal (NetExam) after candidates complete the AT12 Architect training course.
What is the difference between AT12 Architect and ET12 Engineer?
ET12 Engineer covers operational use of Sophos Central XDR / MDR — running Live Discover queries, working Threat Cases, applying detections, and using Live Response. AT12 Architect builds on that foundation with multi-tenant design (Enterprise sub-estates and Partner), Data Lake retention strategy, hunting methodology, detection lifecycle, integration architecture (SIEM, SOAR, API), and MDR service-tier design. Most candidates should complete ET12 before attempting AT12.
How much does AT12 cost?
Sophos typically delivers AT12 free of charge to partners and customers who complete the Architect training course on the Sophos Training Portal. Pricing and partner-tier eligibility can vary, so always check training.sophos.com for current AT12 enablement.
How long is the Sophos AT12 certification valid?
Sophos Architect certifications are typically valid for 2-3 years and require recertification when major Sophos Central or XDR releases reshape the product. Always confirm the current validity window on training.sophos.com.
What MDR service tiers does Sophos offer in 2026?
Sophos offers two MDR tiers: MDR Essentials and MDR Complete. Both include 24/7 monitoring and the standard 90-day Data Lake retention. MDR Complete adds a contractual 60-minute SLA on 90% of high-severity cases, full analyst-led incident response with no extra fees, and a $1M single-claim Breach Protection Warranty. A 1-year extended Data Lake retention add-on is available with either tier.
What is the difference between Live Discover endpoint queries and Data Lake queries?
Endpoint queries hit currently connected devices for live state (running processes, registry, real-time files) using OSquery plus the Sophos endpoint extension schema. Data Lake queries hit telemetry that endpoints have already uploaded to the Sophos-hosted Data Lake; they cover up to 90 days of history (or 1 year with the extended add-on) and can join across endpoint, server, firewall, email, and cloud sources. Architects use endpoint queries for live state and Data Lake queries for historical hunts.