A security analyst is using an nRF Sniffer to capture BLE traffic between a smartwatch and a smartphone. The analyst notices that the traffic is encrypted, but the analyst has the smartphone's link key. Which additional data is required to decrypt the captured traffic?

The session key derived from the link key and the connection parameters (e.g., random numbers) used during the connection.

The smartwatch's public address and the smartphone's public address.

The pairing passkey used during the initial pairing.

The advertising interval and channel map of the connection.

An attacker positions two radios between a BLE smart lock and a user's smartphone during the initial pairing. The attacker wants to intercept and modify the pairing messages so that both devices believe they are paired with each other, but the attacker learns the session key. Which pairing method is most vulnerable to this attack?

Out-of-Band pairing, because the OOB channel is always unencrypted.

Just Works pairing, because it provides no user authentication and is susceptible to an active MITM during pairing.

Numeric Comparison pairing, because it uses a 6-digit number that can be easily guessed.

Passkey Entry pairing, because the 6-digit passkey is transmitted in cleartext during the exchange.

A security analyst is testing a BLE-enabled garage door opener. The analyst captures a valid 'open' command from the smartphone app. The analyst wants to determine if the opener is vulnerable to replay attacks. What is the most effective next step?

Jam the connection and then send the captured command to see if the opener responds.

Replay the captured 'open' command at a later time and observe if the door opens.

Decrypt the captured packet using the smartphone's stored keys to verify the command's integrity.

Send a malformed 'open' command to see if the opener crashes or opens.

A security researcher is testing a BLE medical device that accepts commands over a GATT connection. The researcher wants to discover memory corruption vulnerabilities in the device's firmware without causing a permanent failure. Which approach is most appropriate?

Use a brute-force attack to guess the device's encryption key and then send arbitrary commands.

Send a series of malformed GATT write requests with unexpected lengths and values, monitoring the device's response and rebooting it after each test.

Jam the connection while sending a write request to see if the device crashes.

Capture and replay all GATT write requests from a legitimate app to see if any cause a crash.

GIAC Assessing and Auditing Wireless Networks

Domain 4Objective 2

Bluetooth Low Energy Attacks GAWN Practice Questions (Page 8)

Part of the Bluetooth and BLE Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

10concepts

Questions 36–40

36application · medium
A security analyst is using an nRF Sniffer to capture BLE traffic between a smartwatch and a smartphone. The analyst notices that the traffic is encrypted, but the analyst has the smartphone's link key. Which additional data is required to decrypt the captured traffic?
Select an answer first
37application · medium
An attacker positions two radios between a BLE smart lock and a user's smartphone during the initial pairing. The attacker wants to intercept and modify the pairing messages so that both devices believe they are paired with each other, but the attacker learns the session key. Which pairing method is most vulnerable to this attack?
Select an answer first
38application · medium
A security analyst is testing a BLE-enabled garage door opener. The analyst captures a valid 'open' command from the smartphone app. The analyst wants to determine if the opener is vulnerable to replay attacks. What is the most effective next step?
Select an answer first
39application · medium
A security researcher is testing a BLE medical device that accepts commands over a GATT connection. The researcher wants to discover memory corruption vulnerabilities in the device's firmware without causing a permanent failure. Which approach is most appropriate?
Select an answer first
40foundation · easy
Which BLE pairing method is vulnerable to an attack where the attacker guesses the passkey because it is limited to a small numeric range?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.

Bluetooth Low Energy Attacks GAWN Practice Questions (Page 8)

Questions 36–40

A security analyst is using an nRF Sniffer to capture BLE traffic between a smartwatch and a smartphone. The analyst notices that the traffic is encrypted, but the analyst has the smartphone's link key. Which additional data is required to decrypt the captured traffic?

A security analyst is testing a BLE-enabled garage door opener. The analyst captures a valid 'open' command from the smartphone app. The analyst wants to determine if the opener is vulnerable to replay attacks. What is the most effective next step?

A security researcher is testing a BLE medical device that accepts commands over a GATT connection. The researcher wants to discover memory corruption vulnerabilities in the device's firmware without causing a permanent failure. Which approach is most appropriate?

Which BLE pairing method is vulnerable to an attack where the attacker guesses the passkey because it is limited to a small numeric range?

Keep studying — Bluetooth and BLE Security