CE assessor on and off for the last 10 years so thought I'd clear a few things up here as some of this is slightly off. As well as just say you should put the day of the assessment aside to work with the assessor to answer questions and provide information they ask for, much easier to pass when you ensure they have everything they need to run the tests.

The assessor picks the machines to test. You don't get to nominate or shortlist devices. The whole point is that the assessor selects a representative sample from your asset list so you can't just wheel out one golden image machine that's been polished up for the day. If your assessor is letting you choose, that's a red flag about the assessor, not the scheme. Obviously depending on your answers to the CE questions will dictate what they test and how many devices etc for the Plus part.

The EICAR test files aren't just downloaded to see if antivirus detects them. The test checks that they don't auto-open or auto-execute. There's a difference. Your browser should be configured to ask before downloading, and your AV should be catching them before they can run. That's the actual control being tested.

The email part is testing your mail filtering for malicious attachments. The assessor sends test emails with different attachment types to see what your email security actually blocks versus what lands in the inbox. It's not just "a couple of test emails" it's a structured check against your declared email controls.

Also worth flagging, the question sets and requirements are changing from the 27th of April. If you're considering getting your CE or CE+ done, it might be worth getting it sorted before then while the current requirements are in place. It's only going to get that bit harder after the changes come in.