You are analyzing a Zigbee frame in Wireshark. The Frame Control field indicates a data frame with security enabled. The Auxiliary Security Header shows a frame counter of 0x00000001 and a source address of 0x1234. The payload is encrypted. You have the network key. What is the most likely reason you cannot decrypt the payload?

The source address is not valid for the network.

The frame is encrypted with a link key, not the network key, and you do not have the link key.

The network key has been rotated and you have the old key.

The frame counter is too low and the frame is a replay.

A manufacturer is designing a new line of Zigbee-based smart lighting controls. The devices must operate in a dense urban environment with many other wireless devices. The design team is deciding which frequency band to use. Which Zigbee frequency band is most appropriate for this environment and why?

868 MHz band because it has less interference and longer range, but it is only available in Europe.

2.4 GHz band because it offers higher data rates and global availability, despite potential interference from Wi-Fi and Bluetooth.

Sub-GHz bands are always better because they are immune to interference from Wi-Fi.

915 MHz band because it offers the highest data rate of all Zigbee bands.

During a Zigbee assessment, you notice that a particular end device is sending frequent association requests to the coordinator. The device is not joining the network. What is the most likely cause?

The device is attempting to join but is failing authentication due to an incorrect network key.

The device is performing a denial-of-service attack by flooding the coordinator with association requests.

The device is using a different PAN ID and is trying to join a different network.

The device is in a low-power sleep mode and only wakes to send association requests.

You are performing a Zigbee security assessment for a client. During the reconnaissance phase, you have identified the network's channel and PAN ID. What is the most appropriate next step in the assessment methodology?

Capture and analyze traffic to identify devices, keys, and potential vulnerabilities.

Report the findings to the client and conclude the assessment.

Attempt to extract the network key from a compromised device.

Immediately launch a packet injection attack to test network resilience.

GIAC Assessing and Auditing Wireless Networks

Domain 6Objective 3

Zigbee GAWN Practice Questions (Page 9)

Part of the Advanced Wireless Attacks domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 41–45

41foundation · easy
In the Zigbee protocol stack, which layer is responsible for managing network formation, joining, and routing?
Select an answer first
42expert · hard
You are analyzing a Zigbee frame in Wireshark. The Frame Control field indicates a data frame with security enabled. The Auxiliary Security Header shows a frame counter of 0x00000001 and a source address of 0x1234. The payload is encrypted. You have the network key. What is the most likely reason you cannot decrypt the payload?
Select an answer first
43application · medium
A manufacturer is designing a new line of Zigbee-based smart lighting controls. The devices must operate in a dense urban environment with many other wireless devices. The design team is deciding which frequency band to use. Which Zigbee frequency band is most appropriate for this environment and why?
Select an answer first
44application · medium
During a Zigbee assessment, you notice that a particular end device is sending frequent association requests to the coordinator. The device is not joining the network. What is the most likely cause?
Select an answer first
45application · medium
You are performing a Zigbee security assessment for a client. During the reconnaissance phase, you have identified the network's channel and PAN ID. What is the most appropriate next step in the assessment methodology?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.

Zigbee GAWN Practice Questions (Page 9)

Questions 41–45

In the Zigbee protocol stack, which layer is responsible for managing network formation, joining, and routing?

During a Zigbee assessment, you notice that a particular end device is sending frequent association requests to the coordinator. The device is not joining the network. What is the most likely cause?

You are performing a Zigbee security assessment for a client. During the reconnaissance phase, you have identified the network's channel and PAN ID. What is the most appropriate next step in the assessment methodology?

Keep studying — Advanced Wireless Attacks