Zigbee GAWN Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   In a Zigbee security assessment, what is the purpose of the final reporting phase?

   • ATo document findings, risks, and recommended mitigations
   • BTo exploit identified vulnerabilities
   • CTo capture network traffic for analysis
   • DTo install patches on vulnerable devices
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   You are conducting a Zigbee security assessment for a smart building. The building manager has asked you to identify vulnerabilities without causing any downtime. You have discovered that the network uses a single network key and that some devices have default credentials. Which of the following is the most appropriate next step in your assessment?

   • APerform a network flooding attack to test the network's resilience.
   • BDocument the findings and recommend that the network key be rotated and default credentials be changed.
   • CIgnore the default credentials because they are not a security risk.
   • DImmediately exploit the default credentials to gain access to the devices and prove the vulnerability.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   You are using a TI CC2531 USB dongle to capture Zigbee traffic. You have set the dongle to channel 15 and started Wireshark, but you are not seeing any frames. What is the most likely cause?

   • AThe Zigbee network is operating on a different channel than the one you are monitoring.
   • BThe dongle is not in promiscuous mode.
   • CThe network is using encryption that prevents the dongle from detecting frames.
   • DWireshark does not support Zigbee dissectors.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security firm is assessing a Zigbee-based building automation system. The system uses a single network key distributed to all devices. The assessment goal is to determine whether an attacker who compromises one end device can decrypt traffic between other devices and inject false commands. The assessor has captured encrypted traffic and has extracted the network key from the compromised device. Which additional action is REQUIRED to inject a false command that will be accepted by a target router?

   • APerform a deauthentication attack to force the target router to reset its frame counter
   • BDetermine the current frame counter value for the compromised device and increment it
   • CObtain the link key used between the compromised device and the target router
   • DCapture a valid frame from the target router to learn its network address
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   In a Zigbee mesh topology, which device type is used to relay messages from other devices to extend network range?

   • ASleepy device
   • BRouter
   • CEnd device
   • DCoordinator
   Reveal Solution Discussion Select an answer first