A penetration tester is assessing a BLE heart-rate monitor that uses Just Works pairing. The tester wants to capture and decrypt the communication between the monitor and a smartphone. Which approach is most effective?

Replay the captured pairing packets to force the devices to reuse the same session key

Perform an active MITM attack during pairing to establish separate keys with each device and then decrypt the session

Passively sniff the pairing process and derive the Long Term Key from the captured public keys

Use a brute-force attack on the 6-digit passkey used during pairing

In a BLE MITM attack during pairing, what does the attacker typically do?

Spoofs the device address of one party

Replays previously captured packets

Intercepts and relays messages between the two devices

A BLE device generates its encryption key using a predictable random number generator. An attacker who knows the seed can predict the key and decrypt all traffic. Which BLE key management weakness is being exploited?

Insecure key storage, where the key is stored in plaintext on the device

Lack of key rotation, where the same key is used for a long period

Weak key generation, where the key is derived from a predictable source

Insecure key exchange, where the key is transmitted in plaintext during pairing

A security consultant is assessing a BLE device that supports both Just Works and Passkey Entry pairing. The consultant wants to recommend a configuration that minimizes the risk of MITM attacks during pairing. Which recommendation is most appropriate?

Use a fixed passkey for Passkey Entry to simplify the pairing process.

Disable Passkey Entry and require Just Works pairing for all connections.

Keep both pairing methods enabled and rely on the device's encryption to prevent MITM.

Disable Just Works pairing and require Passkey Entry for all connections.

GIAC Assessing and Auditing Wireless Networks

Domain 4Objective 2

Bluetooth Low Energy Attacks GAWN Practice Questions (Page 3)

Part of the Bluetooth and BLE Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

10concepts

Questions 11–15

11application · hard
A penetration tester is assessing a BLE heart-rate monitor that uses Just Works pairing. The tester wants to capture and decrypt the communication between the monitor and a smartphone. Which approach is most effective?
Select an answer first
12foundation · easy
Which BLE pairing method is most susceptible to MITM attacks because it does not provide authentication?
Select an answer first
13foundation · easy
In a BLE MITM attack during pairing, what does the attacker typically do?
Select an answer first
14application · medium
A BLE device generates its encryption key using a predictable random number generator. An attacker who knows the seed can predict the key and decrypt all traffic. Which BLE key management weakness is being exploited?
Select an answer first
15application · medium
A security consultant is assessing a BLE device that supports both Just Works and Passkey Entry pairing. The consultant wants to recommend a configuration that minimizes the risk of MITM attacks during pairing. Which recommendation is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.