A Zigbee network in a hospital uses a tree topology with a coordinator at the root and multiple routers as intermediate nodes. An attacker wants to disrupt the network's ability to deliver critical patient data to the central monitoring station. The attacker has the ability to jam a single node. Which node should the attacker target to cause the most widespread disruption?

An end device that is a leaf node

A router that is a child of the coordinator

A router that is a parent to many end devices

In Zigbee security, what is the primary purpose of the network key?

To provide a unique key for each device pair

To encrypt and authenticate all network-level broadcast frames

To authenticate the coordinator to the network

To encrypt application-level unicast messages between two devices

A security analyst is capturing Zigbee traffic from a smart meter network. The analyst has the network key and observes that some frames have an APS-layer auxiliary header with a security suite of 0x05 (AES-CCM-64) and a frame counter. The analyst wants to decrypt the APS-layer payload. What additional information is REQUIRED?

The link key used between the source and destination devices

The network key and the source PAN ID

The coordinator's extended address

GIAC Assessing and Auditing Wireless Networks

Domain 6Objective 3

Zigbee GAWN Practice Questions (Page 7)

Part of the Advanced Wireless Attacks domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 31–35

31expert · hard
A Zigbee network in a hospital uses a tree topology with a coordinator at the root and multiple routers as intermediate nodes. An attacker wants to disrupt the network's ability to deliver critical patient data to the central monitoring station. The attacker has the ability to jam a single node. Which node should the attacker target to cause the most widespread disruption?
Select an answer first
32foundation · easy
Which attack on a Zigbee network involves an attacker capturing and later retransmitting a valid frame to cause an unintended action?
Select an answer first
33foundation · easy
Which Zigbee security mechanism is used to ensure that a received frame was not modified in transit?
Select an answer first
34foundation · easy
In Zigbee security, what is the primary purpose of the network key?
Select an answer first
35expert · hard
A security analyst is capturing Zigbee traffic from a smart meter network. The analyst has the network key and observes that some frames have an APS-layer auxiliary header with a security suite of 0x05 (AES-CCM-64) and a frame counter. The analyst wants to decrypt the APS-layer payload. What additional information is REQUIRED?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.

Zigbee GAWN Practice Questions (Page 7)

Questions 31–35

Which attack on a Zigbee network involves an attacker capturing and later retransmitting a valid frame to cause an unintended action?

Which Zigbee security mechanism is used to ensure that a received frame was not modified in transit?

In Zigbee security, what is the primary purpose of the network key?

Keep studying — Advanced Wireless Attacks