Which of the following describes how the EICAR test file is used?

• A. It automatically cleans infected hosts on detection.
• B. It downloads additional samples from the internet.
• C. It serves as a safe test to confirm antivirus is active and monitoring.
• D. It blocks all network traffic when detected.

Answer: (C)

The EICAR test file is used to verify that antivirus protection is active and monitoring. It’s a safe, non-malicious test string that many antivirus programs recognize as malware. When you place this file on a system, a functioning protection layer should detect it and generate an alert, showing that real-time protection and scanning are working. It’s not intended to download anything from the internet, it doesn’t automatically clean infections, and it doesn’t block network traffic; it merely serves as a harmless trigger to confirm the protection is on and responsive. This makes it a quick, safe check in labs and during configuration to validate that the security stack is actually protecting the endpoint.