NFC GAWN Practice Questions (Page 8)

Questions 36–38

1. 36expert · hard

   A security researcher is investigating a reported vulnerability in an NFC-based payment system. The system uses card emulation mode and is based on ISO/IEC 14443. The researcher suspects that the system is vulnerable to eavesdropping because the communication is not encrypted. Which aspect of NFC makes eavesdropping particularly challenging, and how does it affect the attack?

   • AThe passive communication mode means the card does not transmit any data, making eavesdropping impossible.
   • BThe use of a secure element prevents eavesdropping by encrypting all communication.
   • CThe high frequency (13.56 MHz) makes the signal easy to intercept from a distance.
   • DThe short range (a few centimeters) requires the attacker to be very close to the card or reader, limiting the practicality of the attack.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A penetration tester is assessing an NFC-based door lock system. The lock reads a static password from a Type 2 tag. The tester wants to perform a man-in-the-middle (MITM) attack to capture the password and replay it later. Which setup is required?

   • AA device that can emulate a reader to the tag and emulate a tag to the reader, forwarding messages between them.
   • BA smartphone with an NFC reader app to read the tag's memory directly.
   • CA software-defined radio to decode the NFC signal from a distance of 1 meter.
   • DA high-gain antenna to intercept the communication from a distance of 10 meters.
   Reveal Solution Discussion Select an answer first
3. 38expert · hard

   A company is implementing an NFC-based payment system that uses card emulation mode. The system must comply with PCI DSS requirements for protecting cardholder data. The security team is evaluating whether to use a secure element or host card emulation (HCE). Which consideration is most important for PCI DSS compliance?

   • ABoth are equally compliant because PCI DSS does not specify how cardholder data is stored.
   • BThe secure element provides a dedicated hardware environment that is more resistant to tampering and malware.
   • CHCE is more compliant because it uses software-based encryption that is easier to update.
   • DThe choice does not matter because PCI DSS only applies to the payment network, not the mobile app.
   Reveal Solution Discussion Select an answer first