What is the purpose of fuzzing a BLE device?

To impersonate a legitimate device

To capture and analyze normal traffic

To discover vulnerabilities by sending malformed packets

To jam the communication channel

Which countermeasure is most effective in preventing BLE replay attacks?

Using a nonce or timestamp in each packet

Increasing the transmission power

A BLE medical device uses a connection interval of 7.5 ms. An attacker wants to disrupt the device's communication with its monitoring station without being easily detected. Which approach is most effective?

Flood the device with pairing requests to exhaust its resources

Send repeated connection update requests to force the device to use a much longer connection interval, causing timeouts and disconnections

Perform a MITM attack to drop all packets between the device and the monitoring station

Continuously jam the 2.4 GHz channel with a high-power transmitter

What is the primary purpose of using a BLE sniffer like the nRF Sniffer?

To decrypt BLE traffic in real time

To capture and analyze BLE packets for security assessment

A security engineer is tasked with assessing the resilience of a BLE-based industrial sensor network. The sensors broadcast data to a central gateway over BLE connections. The engineer wants to test the network's resistance to denial-of-service attacks without causing permanent damage. The engineer has a limited budget and can only use one tool. Which approach best balances effectiveness and safety?

Use a software-defined radio to continuously transmit on the BLE advertising channels, then stop and verify the sensors reconnect.

Use a BLE sniffer to capture all traffic and then replay it to confuse the gateway.

Send a flood of malformed connection requests to the sensors to exhaust their connection buffers, then reboot the sensors manually.

Perform a MITM attack on the sensor-gateway connections to drop all data packets, then restore the connections.

GIAC Assessing and Auditing Wireless Networks

Domain 4Objective 2

Bluetooth Low Energy Attacks GAWN Practice Questions (Page 10)

Part of the Bluetooth and BLE Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

10concepts

Questions 46–50

46foundation · easy
What is the purpose of fuzzing a BLE device?
Select an answer first
47foundation · easy
Which countermeasure is most effective in preventing BLE replay attacks?
Select an answer first
48expert · hard
A BLE medical device uses a connection interval of 7.5 ms. An attacker wants to disrupt the device's communication with its monitoring station without being easily detected. Which approach is most effective?
Select an answer first
49foundation · easy
What is the primary purpose of using a BLE sniffer like the nRF Sniffer?
Select an answer first
50expert · hard
A security engineer is tasked with assessing the resilience of a BLE-based industrial sensor network. The sensors broadcast data to a central gateway over BLE connections. The engineer wants to test the network's resistance to denial-of-service attacks without causing permanent damage. The engineer has a limited budget and can only use one tool. Which approach best balances effectiveness and safety?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.