NSE7 Advanced Threat Protection Practice Question
What is the primary purpose of Content Disarm and Reconstruction (CDR) in advanced antivirus protection?
⚠ Common exam trap
Many exam-takers confuse CDR with sandboxing or signature-based detection, assuming CDR's purpose is to detect malware rather than to preemptively remove all potentially dangerous content regardless of detection status.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To reconstruct files by removing potentially malicious active content such as macros and scripts
Content Disarm and Reconstruction (CDR) is designed to proactively neutralize threats by stripping or disabling potentially dangerous active content—such as macros, scripts, and embedded objects—from files while preserving the file's usability. Unlike signature-based detection, CDR does not rely on known threat signatures; instead, it reconstructs the file in a safe state, removing any elements that could execute malicious code. This makes CDR a zero-day prevention technique that blocks threats before they can be analyzed or detected by traditional methods.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To detect and block known malware using signature-based detection
Why it's wrong here
That is traditional antivirus; CDR removes active content.
- ✓
To reconstruct files by removing potentially malicious active content such as macros and scripts
Why this is correct
CDR strips active content and rebuilds files to prevent exploits.
- ✗
To submit files to FortiSandbox for behavioral analysis
Why it's wrong here
CDR is a separate feature from sandboxing.
- ✗
To encrypt files in transit to prevent interception
Why it's wrong here
CDR does not encrypt; it sanitizes files.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.