A security consultant is assessing a Bluetooth speaker that supports both legacy pairing and Secure Simple Pairing (SSP). The consultant wants to test the device's resistance to PIN cracking. Which approach is most effective?

Use a tool like Carwhisperer to eavesdrop on the pairing process.

Force the device to use legacy pairing by sending a crafted LMP packet, then capture the pairing exchange and crack the PIN.

Use SSP with numeric comparison and attempt to brute-force the PIN.

Use a tool like BlueSmack to crash the device and then extract the PIN.

A security team is evaluating the risk of BlueBorne in their environment. They have a mix of devices: some are patched, some are not, and some are not Bluetooth-enabled. Which statement best describes the risk?

Devices without Bluetooth enabled are still at risk because BlueBorne can spread over Wi-Fi.

Only devices that are discoverable are at risk.

Only unpatched devices with Bluetooth enabled are at risk.

All devices with Bluetooth enabled are at risk, regardless of patches.

What is the primary goal of a man-in-the-middle (MITM) attack during Bluetooth pairing?

To capture the PIN by sniffing the airwaves

To inject malicious code into the pairing process

To impersonate both devices and establish separate keys with each, allowing interception of traffic

To jam the pairing process and force a re-pair

A security analyst is reviewing a Bluetooth attack that involves sending crafted LMP packets to force a device to re-pair, then capturing the pairing exchange to crack the PIN. How should this attack be classified in the Bluetooth attack taxonomy?

Pairing and bonding vulnerability exploitation

A security consultant is testing a Bluetooth-enabled smart lock. The lock uses legacy pairing with a fixed 4-digit PIN. The consultant wants to demonstrate that an attacker can compromise the lock without physical access to it. Which tool or technique would be MOST appropriate for this demonstration?

Use BlueSmack to flood the lock with L2CAP packets and cause it to reboot into an unauthenticated state.

Use a Bluetooth sniffer to capture the pairing exchange between the lock and the owner's phone, then brute-force the PIN offline.

Use BlueBorne to remotely execute code on the lock and disable the pairing mechanism.

Use Carwhisperer to inject audio commands into the lock's speaker to trick it into unlocking.

GIAC Assessing and Auditing Wireless Networks

Domain 4Objective 1

Bluetooth Attacks GAWN Practice Questions (Page 6)

Part of the Bluetooth and BLE Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

7concepts

Questions 26–30

26expert · hard
A security consultant is assessing a Bluetooth speaker that supports both legacy pairing and Secure Simple Pairing (SSP). The consultant wants to test the device's resistance to PIN cracking. Which approach is most effective?
Select an answer first
27expert · medium
A security team is evaluating the risk of BlueBorne in their environment. They have a mix of devices: some are patched, some are not, and some are not Bluetooth-enabled. Which statement best describes the risk?
Select an answer first
28foundation · easy
What is the primary goal of a man-in-the-middle (MITM) attack during Bluetooth pairing?
Select an answer first
29expert · medium
A security analyst is reviewing a Bluetooth attack that involves sending crafted LMP packets to force a device to re-pair, then capturing the pairing exchange to crack the PIN. How should this attack be classified in the Bluetooth attack taxonomy?
Select an answer first
30application · medium
A security consultant is testing a Bluetooth-enabled smart lock. The lock uses legacy pairing with a fixed 4-digit PIN. The consultant wants to demonstrate that an attacker can compromise the lock without physical access to it. Which tool or technique would be MOST appropriate for this demonstration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.