Which outcome is expected when a system detects the EICAR test file?

• A. It automatically deletes the file after detection.
• B. It runs a full malware payload to test response.
• C. It bypasses the antivirus detection to simulate a threat.
• D. It demonstrates that antivirus is installed and actively monitoring by generating a detectable signal when scanned.

Answer: (D)

The EICAR test file is a safe, standard artifact used to verify that antivirus software is present and functioning. When a system scans and detects this file, you should see a detectable signal such as an alert, notification, or log entry indicating detection. That confirms the antivirus is installed and actively monitoring. It isn’t a real threat, so it isn’t meant to execute malware or cause deletion by default, and it should not bypass detection. The purpose of the test is precisely to demonstrate that protection is in place and responsive.