A BLE device uses a fixed, hardcoded encryption key stored in its firmware. An attacker extracts the key from the firmware and uses it to decrypt all captured traffic. Which BLE key management weakness is being exploited?

Insecure key exchange, where the key is transmitted in plaintext during pairing

Insecure key storage, where the encryption key is embedded in the device firmware

Lack of key rotation, where the same key is used for an extended period

Weak key generation, where the key is derived from a predictable random number generator

What is the primary risk when BLE devices communicate without encryption?

Data can be intercepted and read by an attacker

Devices cannot establish a connection

A security researcher is fuzzing a BLE heart-rate monitor that has a GATT service for heart-rate measurements. The researcher wants to discover vulnerabilities in the firmware's handling of malformed data. The researcher has a limited time window and must avoid crashing the device in a way that requires a physical reset. Which fuzzing strategy is most appropriate?

Replay previously captured legitimate heart-rate data with modified timestamps to see if the device crashes.

Use a BLE jammer to disrupt the connection while sending malformed data to see if the device crashes.

Send a high volume of malformed GATT write requests to the heart-rate measurement characteristic, then wait for the device to reboot automatically.

Send malformed GATT write requests one at a time, waiting for a response after each, and power-cycle the device if it stops responding.

GIAC Assessing and Auditing Wireless Networks

Domain 4Objective 2

Bluetooth Low Energy Attacks GAWN Practice Questions (Page 1)

Part of the Bluetooth and BLE Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

10concepts

Questions 1–5

1foundation · easy
Which BLE pairing method is considered vulnerable to eavesdropping because it does not provide protection against passive interception?
Select an answer first
2application · medium
A BLE device uses a fixed, hardcoded encryption key stored in its firmware. An attacker extracts the key from the firmware and uses it to decrypt all captured traffic. Which BLE key management weakness is being exploited?
Select an answer first
3foundation · easy
What is the primary risk when BLE devices communicate without encryption?
Select an answer first
4expert · hard
A security researcher is fuzzing a BLE heart-rate monitor that has a GATT service for heart-rate measurements. The researcher wants to discover vulnerabilities in the firmware's handling of malformed data. The researcher has a limited time window and must avoid crashing the device in a way that requires a physical reset. Which fuzzing strategy is most appropriate?
Select an answer first
5foundation · easy
During which BLE phase does an attacker have the opportunity to intercept or modify data packets that are exchanged after a connection is established?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.

Bluetooth Low Energy Attacks GAWN Practice Questions (Page 1)

Questions 1–5

Which BLE pairing method is considered vulnerable to eavesdropping because it does not provide protection against passive interception?

A BLE device uses a fixed, hardcoded encryption key stored in its firmware. An attacker extracts the key from the firmware and uses it to decrypt all captured traffic. Which BLE key management weakness is being exploited?

What is the primary risk when BLE devices communicate without encryption?

During which BLE phase does an attacker have the opportunity to intercept or modify data packets that are exchanged after a connection is established?

Keep studying — Bluetooth and BLE Security