220-1102 Question 462
Single answer2. Quarantine infected systemA user reports that their Windows 11 laptop suddenly began opening browser pop-ups, running very slowly, and attempting to send large amounts of traffic on the company Wi-Fi. You suspect malware infection. The user is working remotely and needs the device for later forensic review. What should the technician do FIRST to properly quarantine the infected system while minimizing further spread or data loss?
- A
Disconnect the laptop from all networks by disabling Wi-Fi and unplugging any Ethernet connection, then prevent further use until it can be scanned and remediated
- B
Run a full antivirus scan immediately while the laptop remains connected so the latest malware signatures can be downloaded
- C
Reboot the laptop into normal mode and have the user continue working while monitoring network traffic for additional signs of infection
- D
Copy the user's files to a shared network drive before taking any containment action so business data is preserved
Show answer and explanation
Correct answer: A
Explanation
For A+ Core 2 malware response, the correct first step when quarantining an infected system is to isolate it from the network. This aligns with common incident response and malware-removal best practices: identify the issue, quarantine/isolate the affected device, disable unnecessary connectivity, and then proceed with remediation steps such as updating antimalware tools, scanning, and recovery. Microsoft security guidance and standard incident handling frameworks emphasize containment early in the process to limit propagation and reduce impact. In a real-world environment, technicians should also document the incident, preserve evidence as required by company policy, and avoid actions that could spread the infection, such as transferring files to shared locations before isolation.
- A. Correct.
Correct. Quarantining an infected system begins with containment. Disconnecting the device from wired and wireless networks helps stop malware from spreading, contacting command-and-control servers, exfiltrating data, or attacking other systems. Preventing further user activity also reduces the risk of additional damage or evidence contamination before scanning, remediation, or escalation.
- B. Incorrect.
Incorrect. Although updated signatures are useful, leaving a suspected infected system connected to the network increases the risk of lateral movement, continued data exfiltration, or additional malicious activity. Best practice is to isolate the system first, then perform scanning and remediation in a controlled manner.
- C. Incorrect.
Incorrect. Allowing the user to continue working on a suspected infected system is not an appropriate first response. Rebooting into normal mode may also trigger persistence mechanisms or additional malware activity. The priority is containment, not continued production use.
- D. Incorrect.
Incorrect. Copying files to a shared network drive before containment could spread malicious files, macros, or scripts to network resources. Data preservation may be important, but it should occur only after the system has been isolated and handled according to incident response procedures.