Certified Ethical Hacker (CEH) Practice Question

In Legacy "Just Works" pairing the Temporary Key (TK) is a 128-bit value that is hard-coded to all zeros, giving it no entropy. Because the TK is already known, an attacker who passively records the pairing exchange can compute the Short-Term Key (STK), decrypt the link-key distribution, and obtain the Long-Term Key (LTK). The open-source utility crackle automates this entire process: point it at the captured pcap, and it derives the STK and LTK, enabling decryption of all subsequent encrypted BLE packets such as keyboard reports. The other options either enumerate services (sdptool), target Bluetooth Classic (BlueBugging), or require an active re-pairing attack (hciconfig), none of which yields the existing LTK from the passive capture.