A Zigbee network uses a single network key. An attacker has captured a valid encrypted frame from a legitimate device and wants to perform a replay attack. What is the primary obstacle to the replay succeeding?

The frame will be rejected because the source address is spoofed.

The receiving device will reject the frame because the frame counter is not higher than the last accepted.

The frame will be rejected because the destination address is incorrect.

The frame will be rejected because the network key has changed.

An auditor is capturing Zigbee traffic with a software-defined radio and an analysis tool. The auditor sees frames that contain a network-layer auxiliary header with a security suite indicator of 0x05 (AES-CCM-64) and a frame counter. The auditor wants to decrypt the network-layer payload. What must the auditor obtain to successfully decrypt the captured frames?

The coordinator's extended address and the frame counter

The link key and the destination short address

The network key and the source PAN ID

The trust center link key and the network PAN ID

A security analyst is using a Zigbee sniffer to capture traffic from a smart home network. The analyst sees frames that are encrypted at the network layer but not at the APS layer. The analyst has the network key. Which information can the analyst extract from the captured frames?

The application payload only if the link key is also known

The source and destination network addresses and the application payload

The link key used for APS-layer encryption

Only the source and destination network addresses

GIAC Assessing and Auditing Wireless Networks

Domain 6Objective 3

Zigbee GAWN Practice Questions (Page 1)

Part of the Advanced Wireless Attacks domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 1–5

1application · medium
A Zigbee network uses a single network key. An attacker has captured a valid encrypted frame from a legitimate device and wants to perform a replay attack. What is the primary obstacle to the replay succeeding?
Select an answer first
2foundation · easy
Which Zigbee device type is responsible for forming a new network and assigning network addresses?
Select an answer first
3foundation · easy
What is the first step in a systematic Zigbee security assessment methodology?
Select an answer first
4application · medium
An auditor is capturing Zigbee traffic with a software-defined radio and an analysis tool. The auditor sees frames that contain a network-layer auxiliary header with a security suite indicator of 0x05 (AES-CCM-64) and a frame counter. The auditor wants to decrypt the network-layer payload. What must the auditor obtain to successfully decrypt the captured frames?
Select an answer first
5application · medium
A security analyst is using a Zigbee sniffer to capture traffic from a smart home network. The analyst sees frames that are encrypted at the network layer but not at the APS layer. The analyst has the network key. Which information can the analyst extract from the captured frames?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.

Zigbee GAWN Practice Questions (Page 1)

Questions 1–5

A Zigbee network uses a single network key. An attacker has captured a valid encrypted frame from a legitimate device and wants to perform a replay attack. What is the primary obstacle to the replay succeeding?

Which Zigbee device type is responsible for forming a new network and assigning network addresses?

What is the first step in a systematic Zigbee security assessment methodology?

A security analyst is using a Zigbee sniffer to capture traffic from a smart home network. The analyst sees frames that are encrypted at the network layer but not at the APS layer. The analyst has the network key. Which information can the analyst extract from the captured frames?

Keep studying — Advanced Wireless Attacks