A security researcher is testing an ISO 14443A payment card. The researcher has a Proxmark3 and wants to demonstrate that the card's communication can be eavesdropped at a distance. Which setup is most likely to succeed?

Place the Proxmark3 in field-listener mode with a tuned 13.56 MHz antenna positioned near the card during a transaction.

Use a high-gain directional antenna to jam the reader and force the card to transmit at higher power.

Use a software-defined radio tuned to 433 MHz to capture the card's signal.

Use the Proxmark3 to actively power the card and read its memory without a reader.

A security researcher is analyzing an HF RFID tag that uses a proprietary cipher. The researcher has captured the tag's response to a known challenge and wants to determine if the cipher is weak. Which analysis is most likely to reveal a weakness?

Collect multiple challenge-response pairs and look for statistical biases or patterns in the responses.

Use a logic analyzer to capture the digital signals on the tag's chip.

Try to brute-force the key by testing all possible keys against one captured pair.

Use a spectrum analyzer to measure the tag's power consumption.

A bank deploys an HF RFID system for contactless payment at point-of-sale terminals. The system uses ISO 14443 and supports mutual authentication. A security researcher warns that a relay attack is possible. The bank wants to mitigate relay attacks without changing the card form factor or the existing payment infrastructure. Which of the following is the most effective control?

Use a longer cryptographic key (e.g., 256-bit) for the card authentication

Encrypt all communication between the reader and the backend server

Implement distance bounding protocols in the reader firmware

Require the card to be placed within 2 cm of the reader and use a short timeout

Which countermeasure is most effective at preventing eavesdropping on HF RFID communication?

Using strong encryption on the air interface

Increasing the reader's transmit power

What is the first step in cloning an HF RFID tag?

Erasing the target tag's memory

Reading the tag's memory contents

Disabling the tag's anti-collision mechanism

GIAC Assessing and Auditing Wireless Networks

Domain 5Objective 2

High-Frequency RFID Attacks GAWN Practice Questions (Page 5)

Part of the RFID and NFC Attacks domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 21–25

21expert · medium
A security researcher is testing an ISO 14443A payment card. The researcher has a Proxmark3 and wants to demonstrate that the card's communication can be eavesdropped at a distance. Which setup is most likely to succeed?
Select an answer first
22application · medium
A security researcher is analyzing an HF RFID tag that uses a proprietary cipher. The researcher has captured the tag's response to a known challenge and wants to determine if the cipher is weak. Which analysis is most likely to reveal a weakness?
Select an answer first
23expert · hard
A bank deploys an HF RFID system for contactless payment at point-of-sale terminals. The system uses ISO 14443 and supports mutual authentication. A security researcher warns that a relay attack is possible. The bank wants to mitigate relay attacks without changing the card form factor or the existing payment infrastructure. Which of the following is the most effective control?
Select an answer first
24foundation · easy
Which countermeasure is most effective at preventing eavesdropping on HF RFID communication?
Select an answer first
25foundation · easy
What is the first step in cloning an HF RFID tag?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.