A security team is investigating a suspected cloning attack on their HF RFID access control system. They have captured a suspicious tag that authenticates successfully but has a different UID than any issued card. What is the most likely explanation?

The attacker used a relay attack to authenticate as a legitimate card.

The attacker used a jamming device to bypass authentication.

The attacker guessed the UID and programmed it into a blank tag.

The attacker cloned the data and keys from a legitimate card onto a blank tag with a different UID, and the system does not verify the UID.

A company uses HF RFID tags on IT assets for inventory tracking. The tags are programmed with an asset ID and a location code. A security audit reveals that the tags can be read and written by any NFC-enabled smartphone. The company wants to prevent unauthorized modification of the tag data while still allowing authorized staff to update the location code. Which control would be most effective?

Shield the tags with a metallic cover to prevent all RF communication

Lock the entire tag memory to make it read-only

Use a reader that only reads the tag and does not write

Use tags that support a password-protected write operation

A security consultant is assessing an HF RFID system that uses MIFARE Classic cards. The consultant has captured the necessary data and wants to create a duplicate card that will authenticate to the system. What is the most important step?

Copy only the UID from the original card to a blank card.

Use a generic ISO 15693 tag and write the captured data to it.

Recover the secret key for each sector and then write the data and key to a blank MIFARE Classic card.

Use a high-power reader to overwrite the original card's memory with new data.

Which technique is used to capture HF RFID communication for offline analysis?

Sending a kill command to the tag

Using a high-gain antenna and a software-defined radio

Physically removing the tag's chip

GIAC Assessing and Auditing Wireless Networks

Domain 5Objective 2

High-Frequency RFID Attacks GAWN Practice Questions (Page 8)

Part of the RFID and NFC Attacks domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 36–40

36expert · medium
A security team is investigating a suspected cloning attack on their HF RFID access control system. They have captured a suspicious tag that authenticates successfully but has a different UID than any issued card. What is the most likely explanation?
Select an answer first
37application · medium
A company uses HF RFID tags on IT assets for inventory tracking. The tags are programmed with an asset ID and a location code. A security audit reveals that the tags can be read and written by any NFC-enabled smartphone. The company wants to prevent unauthorized modification of the tag data while still allowing authorized staff to update the location code. Which control would be most effective?
Select an answer first
38application · medium
A security consultant is assessing an HF RFID system that uses MIFARE Classic cards. The consultant has captured the necessary data and wants to create a duplicate card that will authenticate to the system. What is the most important step?
Select an answer first
39foundation · easy
Which frequency range is characteristic of high-frequency (HF) RFID systems?
Select an answer first
40foundation · easy
Which technique is used to capture HF RFID communication for offline analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.

High-Frequency RFID Attacks GAWN Practice Questions (Page 8)

Questions 36–40

A security team is investigating a suspected cloning attack on their HF RFID access control system. They have captured a suspicious tag that authenticates successfully but has a different UID than any issued card. What is the most likely explanation?

A security consultant is assessing an HF RFID system that uses MIFARE Classic cards. The consultant has captured the necessary data and wants to create a duplicate card that will authenticate to the system. What is the most important step?

Which frequency range is characteristic of high-frequency (HF) RFID systems?

Which technique is used to capture HF RFID communication for offline analysis?

Keep studying — RFID and NFC Attacks