Which Windows service, abbreviated as 'RasAuto' in the material, is described as being abused by a China-based APT when disabled?

• A. RasAuto
• B. RasMan
• C. NetLogon
• D. Dnscache

Answer: (A)

The concept here is that Windows services used for automatic remote access can be abused to gain stealthy, persistent connectivity. RasAuto, the Remote Access Auto Connection Manager, is responsible for automatically dialing or establishing VPN/remote access connections without user intervention. Because it can trigger network connections on its own, attackers can exploit or manipulate it to maintain covert remote access or persistence even when defenses try to disable other entry points. The material’s note about a China-based APT abusing RasAuto when it’s disabled highlights how this automatic connection capability can be leveraged by adversaries. The other services have different roles: RasMan is a manager of remote connections but doesn’t itself initiate auto connections; NetLogon handles domain authentication; Dnscache caches DNS entries. Thus RasAuto is the one most described as being abused in this context.