Incident Response and Risk Mitigation BBLC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   After a smart contract exploit that drained $2M from a DeFi protocol, the team completed containment and recovery. During the post-incident analysis, they discovered that the exploit was possible because a code audit had missed a known vulnerability pattern. What is the most important lesson-learned action to prevent a similar incident?

   • AIncrease the monitoring alert thresholds so that only significant anomalies trigger alerts, reducing alert fatigue.
   • BDocument the exploit in the post-incident report and archive it for regulatory compliance.
   • CUpdate the incident response plan to include a mandatory re-audit of any smart contract before it is redeployed after an incident.
   • DRotate all developer keys and update the multi-signature wallet configuration.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A DeFi protocol has two smart contracts: Contract A holds $100 million in user funds and has a known critical vulnerability that would cost $500,000 to fix. Contract B holds $10 million and has a moderate vulnerability that would cost $50,000 to fix. The protocol has a budget of $100,000 for security this quarter. The team must decide how to allocate the budget. What is the BEST decision?

   • AFix Contract A's critical vulnerability first, even though it exceeds the quarterly budget, by reallocating funds from other projects.
   • BSplit the budget equally between both contracts to partially fix both.
   • CFix Contract B's moderate vulnerability because it is within budget.
   • DDo not fix either vulnerability and instead invest in monitoring tools.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In the containment phase of incident response for a blockchain system, what is the primary goal?

   • ATo isolate compromised components to prevent further damage
   • BTo permanently delete all blockchain data
   • CTo restore services to normal operation
   • DTo identify the root cause of the incident
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   During which phase of the incident response lifecycle would an organization document the root cause of a blockchain security incident and update its response procedures?

   • AContainment
   • BLessons Learned
   • CRecovery
   • DPreparation
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A blockchain-based supply chain platform detects that a compromised vendor node is broadcasting forged shipment records to its peers. The platform's governance board wants to stop the spread of the false data immediately while preserving the ability to investigate the vendor's historical transactions. What should the incident response team do first?

   • ARestore the vendor node from the last known-good backup and reconnect it to the network to resume normal operations.
   • BDeploy a smart contract patch that automatically reverses all transactions submitted by the vendor node in the last 24 hours.
   • CIncrease the network's consensus threshold to require more peer confirmations for all new blocks.
   • DIsolate the vendor node from the network and revoke its peer credentials while retaining its signed transaction logs for forensic analysis.
   Reveal Solution Discussion Select an answer first