hardMultiple Choice
220-1102 Practice Question: That their Windows 10 computer is infected with…
A user reports that their Windows 10 computer is infected with ransomware that has encrypted their files. The technician boots into the Windows Recovery Environment and wants to restore the system to a previous restore point. Which command should be used?
⚠ Common exam trap
Watch out — candidates often confuse `vssadmin list shadows` (a query command) with an actual restoration command, or they mistakenly think `wbadmin start recovery` is for System Restore points. Another common mistake is assuming System Restore will recover ransomware-encrypted user files, which it does not.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
rstrui.exe
The correct command is `rstrui.exe`, which launches the System Restore utility. In the Windows Recovery Environment (WinRE), this command opens System Restore so you can revert system files, registry settings, drivers, and installed programs to a previous restore point. However, System Restore does not restore or decrypt personal files that ransomware has encrypted; it only affects the operating system state. The other options are incorrect: `vssadmin list shadows` lists existing shadow copies, `wbadmin start recovery` performs recovery from Windows Backup volumes, and `bootrec /fixboot` repairs the boot sector.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
rstrui.exe
Why this is correct
Launches the System Restore utility, allowing restoration to a previous point.
- ✗
vssadmin list shadows
Why it's wrong here
Lists existing shadow copies but does not restore them.
- ✗
wbadmin start recovery
Why it's wrong here
Used for full system backup recovery, not restore points.
- ✗
bootrec /fixboot
Why it's wrong here
Repairs boot sector, not system files.
Go deeper
Related to this question
Learn chapter
Troubleshoot: Registry Errors
Key term
Backup
A backup is a copy of computer data taken and stored separately so that the original data can be restored if it is lost, damaged, or corrupted.
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
About these practice questions
This 220-1202 question is part of Courseiva's 687-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.