A penetration tester is assessing a Zigbee network that uses a preconfigured network key. The tester captures a valid encrypted frame from a sensor and wants to replay it to the coordinator to trigger a false alarm. What must the tester do to make the replay successful?

Replay the frame exactly as captured

Modify the frame counter to a value higher than the last accepted one

Change the source address to a different device

Disable the security bit in the frame

A penetration tester is assessing a Zigbee mesh network deployed in a smart building. The tester wants to perform a denial-of-service attack that disrupts the entire network with the least number of injected packets. Which node type should the tester target to achieve this goal?

A Zigbee router that is not a coordinator

A Zigbee network engineer is troubleshooting a connectivity issue where a router cannot forward frames to an end device. The engineer captures frames and sees that the destination PAN ID in the MAC header is set to the broadcast PAN ID (0xFFFF). What does this indicate?

The frame is encrypted with the network key

The frame is a beacon request from a coordinator

The frame is a data frame sent to a specific device

The frame is intended for all devices in the network

A security assessor is auditing a Zigbee-based smart lighting system in a corporate office. The assessor captures frames and notices that the MAC-layer payload is encrypted, but the network-layer header is visible. The assessor wants to determine whether the captured frames are protected against replay attacks. Which field in the captured Zigbee frame should the assessor examine to make this determination?

The PAN identifier in the MAC header

The network address in the network-layer header

The 32-bit frame counter in the auxiliary security header

The security suite indicator in the MAC footer

GIAC Assessing and Auditing Wireless Networks

Domain 6Objective 3

Zigbee GAWN Practice Questions (Page 3)

Part of the Advanced Wireless Attacks domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 11–15

11application · medium
A penetration tester is assessing a Zigbee network that uses a preconfigured network key. The tester captures a valid encrypted frame from a sensor and wants to replay it to the coordinator to trigger a false alarm. What must the tester do to make the replay successful?
Select an answer first
12application · medium
A penetration tester is assessing a Zigbee mesh network deployed in a smart building. The tester wants to perform a denial-of-service attack that disrupts the entire network with the least number of injected packets. Which node type should the tester target to achieve this goal?
Select an answer first
13foundation · easy
Which Zigbee exploitation technique is used to overwhelm the network with excessive traffic, causing legitimate devices to be unable to communicate?
Select an answer first
14application · medium
A Zigbee network engineer is troubleshooting a connectivity issue where a router cannot forward frames to an end device. The engineer captures frames and sees that the destination PAN ID in the MAC header is set to the broadcast PAN ID (0xFFFF). What does this indicate?
Select an answer first
15application · medium
A security assessor is auditing a Zigbee-based smart lighting system in a corporate office. The assessor captures frames and notices that the MAC-layer payload is encrypted, but the network-layer header is visible. The assessor wants to determine whether the captured frames are protected against replay attacks. Which field in the captured Zigbee frame should the assessor examine to make this determination?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.

Zigbee GAWN Practice Questions (Page 3)

Questions 11–15

A penetration tester is assessing a Zigbee network that uses a preconfigured network key. The tester captures a valid encrypted frame from a sensor and wants to replay it to the coordinator to trigger a false alarm. What must the tester do to make the replay successful?

A penetration tester is assessing a Zigbee mesh network deployed in a smart building. The tester wants to perform a denial-of-service attack that disrupts the entire network with the least number of injected packets. Which node type should the tester target to achieve this goal?

Which Zigbee exploitation technique is used to overwhelm the network with excessive traffic, causing legitimate devices to be unable to communicate?

A Zigbee network engineer is troubleshooting a connectivity issue where a router cannot forward frames to an end device. The engineer captures frames and sees that the destination PAN ID in the MAC header is set to the broadcast PAN ID (0xFFFF). What does this indicate?

Keep studying — Advanced Wireless Attacks