A security consultant is evaluating a BLE heart-rate monitor that uses legacy pairing with a fixed 6-digit PIN. The consultant wants to demonstrate that an attacker can recover the session key and decrypt captured traffic. Which attack sequence is most appropriate?

Replay the captured pairing request to a different monitor and observe if it accepts the same PIN.

Use a fuzzer to send malformed pairing requests until the monitor reveals the PIN in its response.

Perform a MITM attack during pairing to force the monitor to use Just Works, which requires no PIN and no encryption.

Capture the pairing exchange with a sniffer, then brute-force the PIN offline to derive the short-term key (STK) and decrypt the session.

A security researcher is testing a BLE-enabled medical device for vulnerabilities. The researcher wants to identify memory corruption issues in the device's firmware by sending unexpected data to its GATT characteristics. Which technique should the researcher use?

BLE fuzzing, sending malformed or unexpected values to the device's GATT characteristics

BLE replay, retransmitting previously captured valid commands

BLE sniffing, capturing and analyzing the device's normal communication patterns

BLE spoofing, impersonating the device's server to send fake responses

An attacker is targeting a BLE beacon-based indoor navigation system. The attacker wants to trick users' phones into navigating to a malicious location by broadcasting fake beacon advertisements. Which technique is the attacker using?

Fuzzing the beacon's firmware to alter its advertisement data

Jamming the beacon's frequency to prevent phones from receiving legitimate advertisements

Performing a MITM attack on the beacon's connection to the phone

Spoofing the beacon's MAC address and advertisement payload to impersonate the legitimate beacon

Which of the following is a common target for BLE key management attacks?

The Long Term Key (LTK) stored on the device

What is the primary characteristic of a BLE replay attack?

Modifying the device address in advertisements

Intercepting and decrypting encrypted traffic

Flooding the channel with garbage packets

Capturing and retransmitting valid packets to trigger unauthorized actions

GIAC Assessing and Auditing Wireless Networks

Domain 4Objective 2

Bluetooth Low Energy Attacks GAWN Practice Questions (Page 9)

Part of the Bluetooth and BLE Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

10concepts

Questions 41–45

41application · medium
A security consultant is evaluating a BLE heart-rate monitor that uses legacy pairing with a fixed 6-digit PIN. The consultant wants to demonstrate that an attacker can recover the session key and decrypt captured traffic. Which attack sequence is most appropriate?
Select an answer first
42application · medium
A security researcher is testing a BLE-enabled medical device for vulnerabilities. The researcher wants to identify memory corruption issues in the device's firmware by sending unexpected data to its GATT characteristics. Which technique should the researcher use?
Select an answer first
43application · medium
An attacker is targeting a BLE beacon-based indoor navigation system. The attacker wants to trick users' phones into navigating to a malicious location by broadcasting fake beacon advertisements. Which technique is the attacker using?
Select an answer first
44foundation · easy
Which of the following is a common target for BLE key management attacks?
Select an answer first
45foundation · easy
What is the primary characteristic of a BLE replay attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.