CCSM Advanced Threat Prevention Practice Question
An administrator is configuring Threat Extraction to sanitize documents. The organization requires that all active content be removed from PDF files, but the original file must be retained for auditing. Which Threat Extraction setting should be configured?
⚠ Common exam trap
The trap here is overlooking the 'Original file' setting, which controls retention separately from the sanitization action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable 'Extract' mode and configure the 'Original file' setting to 'Keep'.
Threat Extraction's Extract mode sanitizes files, and the 'Keep' option for the original file retains it for auditing. This combination removes active content while preserving the original. The other options either fail to retain the original or do not enforce sanitization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable 'Extract' mode and set the action to 'Detect'.
Why it's wrong here
Extract mode with Detect action logs the event but does not block the original file. The sanitized file is delivered, but the original may also be delivered, which violates the requirement to remove active content. Detect is insufficient for enforcement, and original retention is not guaranteed.
- ✗
Enable 'Extract' mode and set the action to 'Prevent'.
Why it's wrong here
Extract mode with Prevent action blocks the original file and provides a sanitized version. However, the requirement is to retain the original file for auditing, so Prevent would not keep the original accessible. This setting prioritizes security over retention, which does not meet the auditing need.
- ✓
Enable 'Extract' mode and configure the 'Original file' setting to 'Keep'.
Why this is correct
Extract mode sanitizes the file by removing active content, and configuring the original file to 'Keep' retains it for auditing. This meets both requirements: active content is removed, and the original is available. This setting is specifically designed for scenarios where retention is needed.
- ✗
Enable 'Extract' mode and configure the 'Original file' setting to 'Discard'.
Why it's wrong here
Discarding the original file removes it entirely, which fails the auditing requirement. While active content is removed, the organization cannot review the original file later. This setting is for maximum security but does not support retention.
About these practice questions
Courseiva writes every CCSM question from scratch — 219 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Check Point exam blueprint
This CCSM practice question is part of Courseiva's free Check Point certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSM exam.