Quarantine the Infected System for A+
Short answer
Containment actions include: disconnecting Ethernet and disabling Wi-Fi (or turning off the device if instructed), unplugging external drives and USB devices (after powering down if necessary), and disabling shared folders. Document the machine's network state and any open network connections. If the infection may affect backups or network shares, take steps to protect those resources (e.g., isolate backups) but avoid complex network configuration changes.
Why it appears on the exam
- Given a scenario of suspected malware spreading via shared folders, select the correct immediate containment steps. - Choose the safest way to isolate a laptop that is actively communicating with suspicious remote hosts.
Key concepts
Concept 1
Required terms
quarantine: Isolating the infected system from networks and shared resources to prevent further spread or external communication. quarantine: remove network connectivity, unmount or eject removable media, and limit further user activity on the machine until cleaned.
Example
Technician unplugs Ethernet, turns off Wi-Fi, and instructs the user not to use the machine further.
Concept 2
How Quarantine the Infected System works
Containment actions include: disconnecting Ethernet and disabling Wi-Fi (or turning off the device if instructed), unplugging external drives and USB devices (after powering down if necessary), and disabling shared folders. Document the machine's network state and any open network connections. If the infection may affect backups or network shares, take steps to protect those resources (e.g., isolate backups) but avoid complex network configuration changes.
Example
A laptop with removable USB drives: safely eject and retain drives for scanning on a known-good system.
Concept 3
Common confusion
- Pulling the power plug immediately can be appropriate for ransomware interrupting encryption, but arbitrary power cycling may corrupt data. The decision should be deliberate and documented. - Avoid trying to 'block' traffic at the router unless the technician's scope explicitly includes the router; simple physical isolation is usually adequate and within SOHO scope.
Example
Technician unplugs Ethernet, turns off Wi-Fi, and instructs the user not to use the machine further.
Concept 4
Core 2 (220-1202) question cues
Given a scenario of suspected malware spreading via shared folders, select the correct immediate containment steps; Choose the safest way to isolate a laptop that is actively communicating with suspicious remote hosts.
Example
A laptop with removable USB drives: safely eject and retain drives for scanning on a known-good system.
Sample questions
Select an answer to reveal the explanation. For tracked practice and weak-area review, use the Cultiv8 app.
Q1.An A+ support scenario describes this situation: Technician unplugs Ethernet, turns off Wi-Fi, and instructs the user not to use the machine further. Which answer fits best?
Q2.For this A+ objective, the scenario says: A laptop with removable USB drives: safely eject and retain drives for scanning on a known-good system. What is the best match?
Q3.A support scenario about Quarantine the Infected System feels similar to a nearby topic. What is the safest way to choose an answer?
Practice this lesson in Cultiv8
The app adds tracked practice, targeted remediation, saved session history, and future readiness scoring.
Continue in Cultiv8