Incident Response and Risk Mitigation BBLC Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A blockchain-based identity management system has been compromised. The attacker gained access to a node that stores encrypted identity data and is threatening to release the decryption keys. The system uses a multi-party computation (MPC) scheme where the decryption key is split among five nodes, and any three can reconstruct it. The attacker compromised one node. What is the best containment and recovery strategy?

   • APay the attacker to obtain the decryption keys and then change the system's access controls.
   • BContinue operating with the four remaining nodes and ignore the compromised node, since the attacker only has one of five key shares.
   • CShut down the entire identity management system and restore it from backups taken before the compromise.
   • DIsolate the compromised node, rotate the MPC key shares among the remaining four nodes, and re-encrypt the identity data with the new key shares.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A decentralized finance (DeFi) protocol is conducting a risk assessment to prioritize its security investments. The protocol holds $50 million in a smart contract that has never been audited, $5 million in a multi-signature treasury wallet, and $1 million in a governance token contract that was audited last year. The team has limited budget for mitigation. Which asset should be prioritized for a code audit?

   • AThe $5 million multi-signature treasury wallet, because it controls funds directly.
   • BThe $1 million governance token contract, because it was audited last year and may have new vulnerabilities.
   • CAll three should be audited simultaneously because all assets are equally important.
   • DThe $50 million unaudited smart contract, because it has the highest value and highest vulnerability exposure.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   After a ransomware attack encrypted the servers hosting a company's blockchain nodes, the company restored the nodes from backups. However, the restored nodes are missing the last 10 blocks of transactions. What is the BEST way to restore data integrity and ensure business continuity?

   • ARecreate the missing blocks by guessing the transaction data.
   • BAsk the blockchain network to roll back to the backup point.
   • CReplay the missing transactions from the company's transaction logs and verify them against the network's consensus.
   • DAccept the missing blocks and continue operating with the restored state.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A consortium blockchain for healthcare records is conducting a risk assessment. The network stores patient data, and a vulnerability in the smart contract that manages access control has been identified. The team has limited budget and must choose one mitigation. Which mitigation provides the most immediate reduction of the identified risk?

   • ATrain all users on how to identify phishing emails.
   • BIncrease the number of nodes in the network to improve redundancy and availability.
   • CDeploy an emergency patch to the smart contract that fixes the access control vulnerability.
   • DPurchase cyber insurance to cover potential losses from a data breach.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A blockchain-based payment network suffered a 51% attack where an attacker reorganized the chain and double-spent $10M. The network has a checkpointing mechanism that allows validators to agree on a canonical chain. The team must recover the network while minimizing financial loss and maintaining user trust. What is the most appropriate recovery approach?

   • ACreate a new blockchain from scratch and migrate all user balances based on the pre-attack state.
   • BCoordinate with validators to roll back the chain to the last valid checkpoint before the attack, then replay all legitimate transactions that occurred after that point.
   • CIncrease the network's hash rate by adding more validators to prevent future attacks, then continue with the reorganized chain.
   • DAccept the reorganized chain as canonical and compensate the double-spend victims from a reserve fund.
   Reveal Solution Discussion Select an answer first