A penetration tester is reviewing a Zigbee Implementation for security issues. Which of the following device types is the tester MOST likely testing?

Routers use standard networking protocols such as OSPF, BGP, and IEEE 802.11 Wi-Fi or Ethernet, not Zigbee, which is designed for constrained IoT devices rather than packet-forwarding infrastructure.

Zigbee is based on IEEE 802.15.4 and is widely deployed in IoT environments including smart lighting, thermostats, door locks, and environmental sensors. A penetration tester reviewing a Zigbee implementation would most likely target IoT devices, as Zigbee is purpose-built for low-power, short-range machine-to-machine communication characteristic of IoT architectures. Zigbee security issues such as weak key exchange and insecure pairing are common IoT attack surfaces.

A Web Application Firewall inspects and filters HTTP/S application traffic and operates at Layer 7, with no functional relationship to the Zigbee wireless protocol.

Point of Sale systems communicate over Ethernet, Wi-Fi, or Bluetooth for payment processing and network connectivity, and do not use Zigbee as a protocol.