A security consultant is assessing a BLE smart lock that supports both Just Works and Passkey Entry pairing. The lock's mobile app defaults to Just Works. The consultant wants to demonstrate that an attacker can intercept and modify the unlock command. Which approach is most effective?

Replay the captured pairing packets to force the devices to reuse the same session key

Brute-force the 6-digit passkey used in Passkey Entry pairing

Passively sniff the pairing process and derive the session key from the exchanged public keys

Perform an active MITM attack during the Just Works pairing process to establish independent keys with the phone and the lock

A security auditor is reviewing a BLE device that stores its long-term key (LTK) in a secure element. The auditor wants to assess the risk of key extraction. Which factor most directly affects the difficulty of extracting the LTK?

Whether the device supports Just Works or Passkey Entry pairing.

Whether the device uses a connection interval of 7.5 ms or 30 ms.

Whether the secure element has tamper-resistant features that prevent physical extraction.

Whether the device uses a random or fixed public address.

A security analyst is investigating a report that an unauthorized device in a parking lot is causing employees' Bluetooth-enabled door locks to unlock unexpectedly. The analyst captures BLE traffic with an Ubertooth and sees repeated identical packets that match the unlock command. Which two-phase attack pattern is most consistent with this observation?

The attacker sniffed the unlock command during the connection phase, then replayed it during a later connection attempt.

The attacker fuzzed the advertising packets to crash the lock's firmware, causing it to unlock as a default state.

The attacker used a jamming device to disrupt the connection, causing the lock to enter an unlocked fail-open state.

The attacker performed a MITM attack during pairing to inject a new unlock command into the data transfer phase.

A security analyst is testing a BLE device that uses a connection interval of 7.5 ms. The analyst wants to cause a denial of service by preventing the device from receiving data from its paired smartphone. Which technique is most effective?

Jam the BLE data channels used by the connection to block the smartphone's transmissions.

Send malformed connection update requests to the device to crash its link layer.

Spoof the smartphone's address and send a disconnect request to the device.

Replay the smartphone's previous data packets to confuse the device.

A BLE-enabled door lock uses a rolling code to prevent replay attacks. An attacker captures a valid unlock command and attempts to replay it, but the lock rejects it. Which mechanism is preventing the replay attack?

The rolling code changes with each command, so the replayed packet has an outdated code

The lock uses a short connection interval, so the replayed packet arrives too late

The lock uses a fixed MAC address, so the replayed packet is recognized as a duplicate

The lock uses encryption, so the replayed packet cannot be decrypted

GIAC Assessing and Auditing Wireless Networks

Domain 4Objective 2

Bluetooth Low Energy Attacks GAWN Practice Questions (Page 7)

Part of the Bluetooth and BLE Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

10concepts

Questions 31–35

31expert · hard
A security consultant is assessing a BLE smart lock that supports both Just Works and Passkey Entry pairing. The lock's mobile app defaults to Just Works. The consultant wants to demonstrate that an attacker can intercept and modify the unlock command. Which approach is most effective?
Select an answer first
32application · medium
A security auditor is reviewing a BLE device that stores its long-term key (LTK) in a secure element. The auditor wants to assess the risk of key extraction. Which factor most directly affects the difficulty of extracting the LTK?
Select an answer first
33application · medium
A security analyst is investigating a report that an unauthorized device in a parking lot is causing employees' Bluetooth-enabled door locks to unlock unexpectedly. The analyst captures BLE traffic with an Ubertooth and sees repeated identical packets that match the unlock command. Which two-phase attack pattern is most consistent with this observation?
Select an answer first
34application · medium
A security analyst is testing a BLE device that uses a connection interval of 7.5 ms. The analyst wants to cause a denial of service by preventing the device from receiving data from its paired smartphone. Which technique is most effective?
Select an answer first
35application · medium
A BLE-enabled door lock uses a rolling code to prevent replay attacks. An attacker captures a valid unlock command and attempts to replay it, but the lock rejects it. Which mechanism is preventing the replay attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.