A security assessor is mapping the Bluetooth attack surface of a corporate campus. The assessor has identified a set of Bluetooth radios that are in discoverable mode using hcitool scan. However, the assessor suspects there are additional devices that are in non-discoverable mode but actively communicating. Which approach would MOST effectively identify these hidden devices?

Use a directional antenna with hcitool scan to increase the range and detect devices that are too far away for standard inquiry.

Use a Bluetooth sniffer such as Ubertooth to passively capture inquiry and page scan responses from all nearby devices, including those in non-discoverable mode.

Use sdptool browse against the entire Bluetooth address range to enumerate services on all devices, regardless of discoverability.

Use hcitool inq with a longer inquiry window and repeated scans to catch devices that periodically enter discoverable mode.

A security researcher is demonstrating the Carwhisperer attack to a client. What is the primary capability of this tool?

It can spread malware between Bluetooth devices.

It can eavesdrop on Bluetooth voice calls.

It can crash Bluetooth devices with oversized packets.

It can brute-force Bluetooth PINs.

GIAC Assessing and Auditing Wireless Networks

Domain 4Objective 1

Bluetooth Attacks GAWN Practice Questions (Page 3)

Part of the Bluetooth and BLE Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

7concepts

Questions 11–15

11application · medium
A security assessor is mapping the Bluetooth attack surface of a corporate campus. The assessor has identified a set of Bluetooth radios that are in discoverable mode using hcitool scan. However, the assessor suspects there are additional devices that are in non-discoverable mode but actively communicating. Which approach would MOST effectively identify these hidden devices?
Select an answer first
12foundation · easy
Which of the following is an example of a Bluetooth attack that targets the link layer?
Select an answer first
13application · easy
A security researcher is demonstrating the Carwhisperer attack to a client. What is the primary capability of this tool?
Select an answer first
14foundation · easy
Which Bluetooth attack tool is used to eavesdrop on audio conversations in a car's hands-free system?
Select an answer first
15foundation · easy
Which command-line tool is used to perform Bluetooth device discovery and list nearby discoverable devices?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.

Bluetooth Attacks GAWN Practice Questions (Page 3)

Questions 11–15

Which of the following is an example of a Bluetooth attack that targets the link layer?

A security researcher is demonstrating the Carwhisperer attack to a client. What is the primary capability of this tool?

Which Bluetooth attack tool is used to eavesdrop on audio conversations in a car's hands-free system?

Which command-line tool is used to perform Bluetooth device discovery and list nearby discoverable devices?

Keep studying — Bluetooth and BLE Security