Zigbee GAWN Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A Zigbee network uses a trust center that distributes a network key to new devices. An attacker has captured the network key from a compromised device. The attacker wants to join the network as a new device to perform further attacks. What additional information is REQUIRED to successfully join the network?

   • AThe trust center link key
   • BThe frame counter of the compromised device
   • CThe network's PAN ID
   • DThe coordinator's extended address
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A Zigbee network uses a tree topology with a coordinator at the root and several routers as intermediate nodes. An attacker wants to perform a denial-of-service attack by targeting a single router. What is the most likely impact on the network?

   • AOnly the coordinator will be affected, and end devices will continue to communicate with each other.
   • BThe network will automatically reroute traffic through other routers, so there is no impact.
   • COnly the devices that rely on that router for their path to the coordinator will lose connectivity.
   • DThe entire network will lose connectivity because the router is essential for all traffic.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is planning to deploy Zigbee sensors in a factory with many metal obstacles. The sensors need to communicate reliably over a distance of about 50 meters. Which Zigbee feature is most important to ensure reliable communication in this environment?

   • AHigh transmit power, which can overcome all obstacles.
   • BMesh networking, which allows frames to be routed around obstacles via intermediate devices.
   • CThe use of a star topology to minimize the number of hops.
   • DThe use of the 2.4 GHz band, which has better penetration through metal.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst is examining a captured Zigbee frame. The frame has a MAC header with a frame type of 0b001 (data), a destination PAN ID of 0x1234, and a destination short address of 0x0000. The network-layer header shows a source address of 0x5678 and a destination address of 0x0000. The frame is encrypted at the network layer. Which device is the intended recipient of this frame?

   • AA specific router with address 0x5678
   • BAn end device with address 0x0000
   • CAll devices in the PAN
   • DThe Zigbee coordinator
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During a Zigbee penetration test, you are capturing traffic on a known channel. You notice that the captured frames show a valid Frame Control field and a valid FCS, but the payload appears to be encrypted. You have the network key. What is the next step to decrypt the captured frames in Wireshark?

   • ARe-capture the traffic using a second adapter in promiscuous mode to obtain unencrypted frames.
   • BUse the 'Decryption' menu in Wireshark to automatically derive the key from the captured key exchange.
   • CConfigure the network key in the Zigbee dissector preferences and set the correct security level and key type.
   • DExport the frames to a text file and use a custom script to strip the encryption header.
   Reveal Solution Discussion Select an answer first