Bluetooth Low Energy Attacks GAWN Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which technique is used to disrupt BLE communication by overwhelming the channel with interference?

   • ASniffing
   • BReplaying
   • CSpoofing
   • DJamming
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team is assessing a BLE proximity badge that unlocks a door when it receives a specific command from a reader. The team wants to identify which phases of the BLE attack surface are most relevant to a replay attack. Which combination of phases is most directly involved?

   • AConnection phase only, because the attacker only needs to capture the connection request.
   • BAdvertising phase only, because the command is broadcast in the advertisement.
   • CAdvertising phase (to discover the badge) and connection phase (to capture the unlock command).
   • DData transfer phase only, because the command is sent after the connection is established.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is investigating a BLE device that stores its long-term key (LTK) in flash memory without encryption. The analyst wants to demonstrate that an attacker who gains physical access to the device can extract the LTK and use it to decrypt past and future communications. Which additional capability is required for this attack to succeed?

   • AThe attacker must know the device's public address to correlate the traffic.
   • BThe attacker must have the smartphone's private key to decrypt the session.
   • CThe attacker must also capture the encrypted BLE traffic between the device and its paired smartphone.
   • DThe attacker must be within radio range during the pairing process to capture the initial key exchange.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is investigating a smart lock that intermittently unlocks without user action. The analyst captures BLE traffic with an Ubertooth and observes that the lock accepts a command packet that was previously captured during a legitimate unlock. The packet's access address and CRC are identical to the original. Which attack is the analyst most likely witnessing?

   • AA BLE replay attack, where the captured unlock command is retransmitted to the lock
   • BA BLE MITM attack, where the attacker relays packets between the phone and lock in real time
   • CA BLE spoofing attack, where the attacker impersonates the phone's address to send new commands
   • DA BLE fuzzing attack, where malformed packets are sent to trigger unintended behavior
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is investigating a BLE device that is communicating with a smartphone. The analyst wants to capture the BLE traffic to understand the communication patterns and identify any unencrypted data. Which tool is most appropriate for this task?

   • AUbertooth, which can capture BLE advertisements and connection packets on the 2.4 GHz band
   • BKismet, which is primarily a Wi-Fi and Bluetooth Classic sniffer, not BLE
   • CAircrack-ng, which is designed for Wi-Fi security testing and can also capture BLE
   • DWireshark with a standard Wi-Fi adapter, which can capture BLE traffic on the same band
   Reveal Solution Discussion Select an answer first