What is the main function of Threat Extraction?

Question

Options

• ABlocks signature-based malware
• BRuns suspicious files in a sandbox
• CRemoves potentially malicious content from files
• DChecks URLs against the reputation database

• A
  10% (2)
• B
  5% (1)
• C
  86% (18)

Explanation

Threat Extraction (also known as Content Disarm and Reconstruction, or CDR) sanitizes files by stripping out potentially malicious active content - such as macros, embedded scripts, and linked objects - and delivering a clean, reconstructed version to the user. This makes option C correct because the file itself is not blocked or analyzed for behavior; it is simply disarmed of risky components before delivery.

Option A describes traditional signature-based antivirus, which matches known malware patterns rather than modifying file content. Option B describes Threat Emulation (sandboxing), a separate but complementary technology that executes suspicious files in an isolated environment to observe behavior. Option D describes URL filtering, which checks web addresses against a reputation or category database - an entirely different inspection layer.

Memory tip: Focus on the word extraction - Threat Extraction pulls out the dangerous parts of a file, like removing a splinter, so the rest can pass through safely. If you're thinking "run it and watch it," that's Emulation; if you're thinking "strip it and send it," that's Extraction.

No community discussion yet for this question.