A security tester is assessing a Bluetooth speaker that supports both legacy pairing and Secure Simple Pairing (SSP). The tester wants to perform a man-in-the-middle (MITM) attack during pairing. Which pairing mode would be MOST susceptible to this attack?

SSP with Numeric Comparison, where both devices display a 6-digit number that the user must confirm.

Legacy pairing with a fixed 4-digit PIN, where the user enters the same PIN on both devices.

SSP with Passkey Entry, where one device displays a 6-digit number and the user enters it on the other device.

SSP with Out of Band (OOB) pairing, where a near-field communication (NFC) channel is used to exchange pairing information.

A company uses Bluetooth headsets for customer service representatives. They want to mitigate the risk of eavesdropping on calls. Which control is most effective?

Use headsets that support Secure Simple Pairing (SSP) with numeric comparison.

Disable Bluetooth discoverability on all headsets.

Use a tool like Ubertooth to monitor for eavesdropping attacks.

Use a Bluetooth jammer to block unauthorized connections.

A security assessor wants to systematically categorize Bluetooth attacks to plan a penetration test. Which classification scheme is most commonly used to organize Bluetooth attacks?

By the Bluetooth version (e.g., 2.0, 4.0, 5.0) and the vendor

By the encryption algorithm used (e.g., E0, AES-CCM) and key length

By the attacker's physical distance from the target (e.g., close, intermediate, long range)

By the target layer (e.g., physical, link, network, application) and the attack type (e.g., eavesdropping, DoS, malware)

A security analyst is investigating a suspected Bluetooth data leak from a wireless presenter. The analyst has an Ubertooth One and has captured a piconet's hopping sequence. The analyst now wants to decrypt the captured traffic. What additional information is REQUIRED to decrypt the traffic?

The service discovery protocol (SDP) records of the presenter.

The Bluetooth address of the slave device.

The master device's clock value at the time of capture.

The link key that was established during the initial pairing process.

GIAC Assessing and Auditing Wireless Networks

Domain 4Objective 1

Bluetooth Attacks GAWN Practice Questions (Page 7)

Part of the Bluetooth and BLE Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

7concepts

Questions 31–35

31application · medium
A security tester is assessing a Bluetooth speaker that supports both legacy pairing and Secure Simple Pairing (SSP). The tester wants to perform a man-in-the-middle (MITM) attack during pairing. Which pairing mode would be MOST susceptible to this attack?
Select an answer first
32application · medium
A company uses Bluetooth headsets for customer service representatives. They want to mitigate the risk of eavesdropping on calls. Which control is most effective?
Select an answer first
33application · medium
A penetration tester is assessing a Bluetooth printer that is not discoverable. The tester has the printer's MAC address from a previous assessment. Which tool can be used to connect to the printer and enumerate its services?
Select an answer first
34foundation · easy
A security assessor wants to systematically categorize Bluetooth attacks to plan a penetration test. Which classification scheme is most commonly used to organize Bluetooth attacks?
Select an answer first
35application · medium
A security analyst is investigating a suspected Bluetooth data leak from a wireless presenter. The analyst has an Ubertooth One and has captured a piconet's hopping sequence. The analyst now wants to decrypt the captured traffic. What additional information is REQUIRED to decrypt the traffic?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.