Use the harmless test file to prove your protection alerts, then scan from outside

short · 40 min · Objective 2.2

Task

Confirm that endpoint protection is actually working using the EICAR test file -- a published, harmless string that every product detects by specification -- and then boot the guest from separate media and scan its disk offline. The second half is the technique that matters, because a compromised system is an unreliable narrator.

Steps

  1. Record the guest's protection state in lab/detect/protection.csv with header item,value covering the product, whether real-time protection is on, the definition date and whether tamper protection is enabled.
  2. Create the EICAR test file on the guest, observe the alert, and record what the product reported in lab/detect/alert.txt -- the name it used, the path, and the action it took.
  3. Boot the guest from offline rescue media and scan its disk. Record the tool, the duration and the result in lab/detect/offline.csv with header tool,scope,duration_min,result.
  4. Write lab/detect/signals.csv with header observation,act_on_it,or_just_an_old_machine,discriminator with at least eight observations split between the two lists.
  5. Write lab/detect/outside.md explaining why a clean result from the running system is weaker evidence than a clean result from rescue media, and listing three ways to look at a machine from outside.

Verify

awk -F, 'NR>1 && NF>=2 {n++} END {print n" protection item(s)"}' lab/detect/protection.csv
grep -Eic 'eicar|test' lab/detect/alert.txt
awk -F, 'NR>1 && NF>=4 {n++} END {print n" offline scan(s)"}' lab/detect/offline.csv
awk -F, 'NR>1 && NF>=4 {n++} END {print n" signal(s)"}' lab/detect/signals.csv
awk -F, 'NR>1 && $2 ~ /yes/ {n++} END {print n" worth acting on"}' lab/detect/signals.csv
grep -Ec '^[-*0-9]' lab/detect/outside.md

Four protection items, an alert recorded by name, an offline scan performed, eight signals split across both lists, and three outside routes. If the EICAR file produced no alert, the protection is not doing what the console says -- which is itself the finding.

Notes

This is the only artefact any lab in this course uses, and it is harmless by construction: a short published string that every product is expected to detect. It cannot do anything, which is precisely why it is the right tool for testing that detection works.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.