Zigbee GAWN Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   When capturing Zigbee traffic, what is the first step to ensure the capture device is on the correct channel?

   • AInstall the Zigbee dissector
   • BUse a directional antenna
   • CDisable encryption on the capture device
   • DSet the radio dongle to the same channel as the target Zigbee network
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A Zigbee network uses a trust center that distributes a single network key to all devices. An assessor discovers that the network key is hard-coded in a publicly available firmware image. The assessor wants to demonstrate the impact of this key compromise. Which attack would be MOST effective in demonstrating the impact?

   • ACapturing link keys from the trust center
   • BImpersonating the trust center to distribute a new network key
   • CDecrypting all captured network-layer traffic and injecting forged frames
   • DPerforming a denial-of-service attack by flooding the coordinator
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A Zigbee network administrator wants to improve security by ensuring that each pair of devices uses a unique key for application-layer communication. Which key type should be used?

   • ANetwork keys, which are shared by all devices in the network.
   • BLink keys, which are established between two devices and used for application-layer security.
   • CMaster keys, which are used only during the initial key establishment.
   • DPre-configured keys, which are installed on all devices at manufacturing time.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security consultant is assessing a Zigbee network that uses a single network key shared by all devices. The consultant has successfully extracted the network key from a compromised device. Which additional attack becomes feasible with this key?

   • ARecovering the coordinator's 64-bit extended address.
   • BDecrypting all network-layer traffic and injecting valid frames into the network.
   • CPerforming a denial-of-service attack by sending deauthentication frames.
   • DDecrypting application-layer traffic that uses link keys.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   You are using a Zigbee sniffer to capture traffic from a network that uses a single network key. You have successfully captured frames and have the network key. In Wireshark, you have configured the key and the security level. However, some frames are still not decrypted. What is the most likely reason?

   • AThose frames are encrypted with a link key, not the network key.
   • BThe frames are beacon frames that are never encrypted.
   • CThe frames are corrupted and cannot be decrypted.
   • DThe frames are from a different Zigbee network on the same channel.
   Reveal Solution Discussion Select an answer first