Content Disarm and Reconstruction (CDR) Log
An administrator sees the following log entry: 'id=13593 msg="CDR: File attachment sanitized"' Which feature generated this log?
Quick Answer
The answer is Content Disarm and Reconstruction (CDR). This feature generated the log because CDR sanitizes file attachments by stripping active content—such as macros, scripts, or embedded objects—and reconstructing a safe, clean version of the file. The log entry “File attachment sanitized” directly confirms that CDR, which is configured within the antivirus profile on FortiGate, has successfully processed an attachment. On the Fortinet NSE 7 Advanced Security NSE7 exam, this log is a common indicator that tests your ability to distinguish CDR from other security features like virus scanning or data leak prevention; a frequent trap is confusing it with a simple antivirus detection, but CDR’s unique action is sanitization rather than deletion or quarantine. Remember the mnemonic: “CDR Cleans, Doesn’t Delete—it Reconstructs.”
⚠ Common exam trap
A common mix-up: candidates confuse the 'sanitized' action with sandboxing or ML-based detection, but CDR is a distinct proactive technology that does not rely on detection—it always sanitizes regardless of threat verdict.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Content Disarm and Reconstruction
The log entry 'CDR: File attachment sanitized' is generated by Content Disarm and Reconstruction (CDR). CDR works by removing active content (e.g., macros, scripts, embedded objects) from files and rebuilding them into a safe, sanitized version. This is distinct from sandboxing or machine learning, as CDR does not rely on detection but instead proactively neutralizes threats by reconstructing the file.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Content Disarm and Reconstruction
Why this is correct
CDR sanitizes attachments and logs such events.
- ✗
FortiSandbox
Why it's wrong here
FortiSandbox analyzes files, but the log specifically mentions CDR.
- ✗
Machine Learning Engine
Why it's wrong here
ML engine detects malware, but does not sanitize attachments.
- ✗
Outbreak Prevention
Why it's wrong here
Outbreak prevention blocks outbreaks, not attachment sanitization.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which FortiGate security feature removes potentially malicious active content from files (e.g., macros, scripts) before delivering them to end users?
easy- A.Antivirus
- B.Data Leak Prevention
- C.File Filter
- ✓ D.Content Disarm and Reconstruction
Why D: Content Disarm and Reconstruction (CDR) is the correct answer because it specifically removes potentially malicious active content—such as macros, scripts, and embedded objects—from files (e.g., Office documents, PDFs) by stripping the active elements and reconstructing a safe, sanitized version before delivery. Unlike traditional scanning, CDR does not rely on signatures or heuristics; it assumes the file could be malicious and proactively neutralizes threats by rebuilding the file with only safe, static content.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.