Which FortiGate security feature can reconstruct files to remove potentially malicious content while preserving the file's usability?
CDR disinfects files by removing active content and rebuilding them.
Why this answer
Content Disarm and Reconstruction (CDR) is the correct answer because it actively removes potentially malicious content—such as macros, scripts, or embedded objects—from files (e.g., Office documents, PDFs) and then reconstructs a clean, usable version. Unlike detection-based approaches, CDR eliminates threats by sanitizing the file structure itself, ensuring the file remains functional for the end user while blocking exploits.
Exam trap
The trap here is that candidates often confuse FortiSandbox's detection capabilities with CDR's proactive sanitization, mistakenly thinking sandboxing can reconstruct files when it only analyzes and blocks them.
How to eliminate wrong answers
Option A is wrong because Antivirus outbreak prevention relies on signature-based detection and blocking of known malware patterns, not on file reconstruction or sanitization. Option C is wrong because FortiSandbox uses behavioral analysis and sandboxing to detect unknown threats, but it does not reconstruct files to remove malicious content; it only provides verdicts and can block or quarantine files. Option D is wrong because IPS application control focuses on detecting and preventing network-level attacks and application misuse, not on file-level content sanitization or reconstruction.