The RasAuto service is described as what in the source material?

• A. An enabled service often abused by APTs
• B. A service used for Windows updates
• C. A service used to manage printers
• D. A disabled service abused by a China-based APT

Answer: (D)

RasAuto is the Windows Remote Access Auto Connection Manager, which automatically establishes network connections (such as dial-up or VPN connections) when resources are accessed. The material describes it as a disabled service that is abused by a China-based APT. This matches the idea that, by default, the service isn’t active, but if an attacker needs covert network access, they can leverage or re-enable it to establish a connection for persistence or C2. The other options misstate its purpose (not Windows updates or printer management) and don’t align with the description of being disabled and used by a specific APT.