Bluetooth Attacks GAWN Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security consultant is demonstrating Bluetooth vulnerabilities to a client. The consultant wants to show how an attacker can eavesdrop on a phone call made through a Bluetooth car kit. Which tool or technique would be MOST appropriate for this demonstration?

   • AUse BlueBorne to remotely execute code on the car kit and enable audio recording.
   • BUse Carwhisperer to connect to the car kit and inject or capture audio.
   • CUse a Bluetooth sniffer to capture the encrypted traffic between the phone and the car kit.
   • DUse BlueSmack to flood the car kit with L2CAP packets and cause it to reboot.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a key countermeasure to mitigate Bluetooth denial-of-service attacks?

   • AUsing a Bluetooth jammer
   • BDisabling discoverable mode
   • CUsing a longer PIN
   • DKeeping firmware updated
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is categorizing Bluetooth attacks for a risk assessment. The analyst has identified an attack where an attacker sends a large number of pairing requests to a Bluetooth speaker, causing it to become unresponsive. How should this attack be classified in the Bluetooth attack taxonomy?

   • AA reconnaissance attack targeting the service discovery layer.
   • BA man-in-the-middle attack targeting the application layer.
   • CA denial-of-service attack targeting the link layer.
   • DAn eavesdropping attack targeting the transport layer.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A penetration tester is assessing a legacy Bluetooth headset that uses PIN-based pairing. The tester has captured the pairing exchange between the headset and a user's phone. The tester wants to recover the link key to decrypt subsequent encrypted traffic. Which attack technique is MOST appropriate in this scenario?

   • APerform a PIN cracking attack by brute-forcing the 4-digit PIN against the captured pairing exchange to derive the link key.
   • BUse Carwhisperer to inject audio into the headset and trick the user into revealing the PIN.
   • CReplay the captured pairing exchange to force the headset to reuse the same link key without knowing the PIN.
   • DUse BlueBorne to exploit a stack overflow in the headset's Bluetooth implementation to extract the link key from memory.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of Bluetooth eavesdropping attacks?

   • ATo disrupt communication between devices
   • BTo bypass authentication and gain unauthorized access
   • CTo capture and analyze Bluetooth traffic to extract sensitive information
   • DTo inject malicious packets into the Bluetooth stream
   Reveal Solution Discussion Select an answer first