Bluetooth Low Energy Attacks GAWN Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A BLE device is connected to a smartphone and uses a connection interval of 30 ms. An attacker wants to disrupt the connection without being easily detected. Which approach is most effective?

   • ASend a connection update request to change the connection interval to 4 seconds, causing the device to time out and disconnect
   • BContinuously jam the 2.4 GHz channel with a high-power transmitter
   • CPerform a MITM attack to drop all packets between the device and the smartphone
   • DFlood the device with pairing requests to exhaust its resources
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which BLE phase is primarily associated with the transmission of advertisement packets that include device address and service UUIDs?

   • APairing phase
   • BAdvertising phase
   • CData transfer phase
   • DConnection phase
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary goal of a BLE spoofing attack?

   • ATo impersonate a legitimate device by using its address and advertisements
   • BTo capture and replay data packets
   • CTo decrypt encrypted BLE traffic
   • DTo disrupt communication by flooding the channel
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A penetration tester is assessing a BLE-enabled access control system. The tester wants to trick users into connecting their smartphones to a rogue device that mimics the legitimate access reader. Which approach best achieves this goal while also potentially disrupting legitimate connections?

   • APerform a passive sniffing attack to capture the reader's advertising interval and then replicate it exactly.
   • BSpoof the access reader's MAC address and advertising packet, then transmit with higher power to override the legitimate advertisement.
   • CUse a BLE jammer to block all advertising channels, preventing any device from connecting to the legitimate reader.
   • DSend malformed connection requests to the legitimate reader to crash its firmware, then broadcast a generic advertisement.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security analyst is investigating a BLE door lock that uses a rolling code to prevent replay attacks. The analyst has captured a valid unlock command and the subsequent unlock command from the same smartphone. The analyst wants to determine if the rolling code is predictable. Which analysis is most appropriate?

   • AExtract the encryption key from the smartphone's app to decrypt the rolling code.
   • BSend a malformed unlock command to see if the lock accepts it and reveals the next code.
   • CReplay the first captured unlock command to see if the door opens.
   • DCompare the two captured unlock commands to see if the rolling code increments by a constant value.
   Reveal Solution Discussion Select an answer first