A penetration tester is evaluating an ISO 14443 payment terminal. The tester wants to demonstrate that a relay attack is possible without modifying the card or the terminal. What is the minimum equipment needed?

A blank tag and a Proxmark3 to clone the card.

Two Proxmark3 devices, one to communicate with the card and one to communicate with the terminal.

A software-defined radio and a high-gain antenna to jam the terminal.

One Proxmark3 and a laptop to replay captured data.

A penetration tester is assessing an HF RFID system that uses ISO 15693 tags. The tester successfully reads the tag's UID and user memory using a Proxmark3. The tester then writes the UID and memory contents to a blank tag and finds that the blank tag is accepted by the reader. Which of the following is the most likely reason the clone was accepted?

The blank tag has a different UID that the reader does not check

The reader only verifies the UID and does not perform any cryptographic authentication

The blank tag is programmed with a different memory layout that the reader ignores

The reader uses a static key that is the same for all tags

Which cryptographic weakness is commonly found in older HF RFID systems like MIFARE Classic?

Use of a proprietary, weak stream cipher

A retail store uses HF RFID tags on high-value items for theft prevention. The tags are deactivated at the point of sale. A shoplifter discovers that they can use a small device to permanently deactivate the tag before leaving the store, bypassing the alarm. Which of the following is the most likely method the shoplifter used?

Overloading the tag with a high-power RF signal to cause a permanent short circuit

Using a magnet to physically damage the tag's antenna

Placing the tag in a microwave oven to destroy the chip

Sending a kill command to the tag using the same protocol as the point-of-sale deactivator

A security assessor is testing an ISO 14443-based access control system. The assessor wants to demonstrate that an attacker positioned near a legitimate cardholder can authenticate to a reader without possessing the card. Which tool and technique would best accomplish this?

Use a Proxmark3 to relay the reader's challenge to the legitimate card and forward the card's response back to the reader in real time.

Use a high-gain antenna to capture the card's UID and then program a blank tag with that UID.

Use a software-defined radio to record the card's response to a known challenge, then replay that exact response later.

Use a jamming device to block the reader's field, then present a previously cloned card.

GIAC Assessing and Auditing Wireless Networks

Domain 5Objective 2

High-Frequency RFID Attacks GAWN Practice Questions (Page 4)

Part of the RFID and NFC Attacks domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 16–20

16application · medium
A penetration tester is evaluating an ISO 14443 payment terminal. The tester wants to demonstrate that a relay attack is possible without modifying the card or the terminal. What is the minimum equipment needed?
Select an answer first
17application · medium
A penetration tester is assessing an HF RFID system that uses ISO 15693 tags. The tester successfully reads the tag's UID and user memory using a Proxmark3. The tester then writes the UID and memory contents to a blank tag and finds that the blank tag is accepted by the reader. Which of the following is the most likely reason the clone was accepted?
Select an answer first
18foundation · easy
Which cryptographic weakness is commonly found in older HF RFID systems like MIFARE Classic?
Select an answer first
19application · medium
A retail store uses HF RFID tags on high-value items for theft prevention. The tags are deactivated at the point of sale. A shoplifter discovers that they can use a small device to permanently deactivate the tag before leaving the store, bypassing the alarm. Which of the following is the most likely method the shoplifter used?
Select an answer first
20application · medium
A security assessor is testing an ISO 14443-based access control system. The assessor wants to demonstrate that an attacker positioned near a legitimate cardholder can authenticate to a reader without possessing the card. Which tool and technique would best accomplish this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.

High-Frequency RFID Attacks GAWN Practice Questions (Page 4)

Questions 16–20

A penetration tester is evaluating an ISO 14443 payment terminal. The tester wants to demonstrate that a relay attack is possible without modifying the card or the terminal. What is the minimum equipment needed?

Which cryptographic weakness is commonly found in older HF RFID systems like MIFARE Classic?

A security assessor is testing an ISO 14443-based access control system. The assessor wants to demonstrate that an attacker positioned near a legitimate cardholder can authenticate to a reader without possessing the card. Which tool and technique would best accomplish this?

Keep studying — RFID and NFC Attacks