Auditing, Testing, and Monitoring in Blockchain Security BDC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During a manual audit of a DeFi lending contract, an auditor notices that the contract updates the user's balance after transferring tokens out. The auditor wants to confirm whether this is a reentrancy vulnerability. Which combination of actions would best validate the finding?

   • ARun a fuzzer with random inputs to see if the contract reverts, and if it does not revert, conclude there is no reentrancy issue.
   • BTrace the external call and check whether the contract uses a reentrancy guard or follows the checks-effects-interactions pattern, then run a static analysis tool to confirm.
   • CReview the contract's test coverage and if the unit tests pass, conclude that the contract is secure.
   • DCheck the contract's gas usage and if it is below the block gas limit, assume the transfer is safe.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A smart contract team is using a static analysis tool and a fuzzer in their CI pipeline. They want to ensure that the tools do not slow down development too much. Which practice best balances security and development speed?

   • ARun the fuzzer on every commit and the static analysis tool only on release branches.
   • BRun both tools only on release branches to minimize disruption.
   • CRun the static analysis tool on every commit, and run the fuzzer on a nightly schedule or on pull requests that change critical contracts.
   • DRun both tools on every commit to ensure maximum security.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A fintech company is deploying a blockchain solution that handles personal data of EU citizens. The compliance officer requires that the audit demonstrate adherence to GDPR data protection principles. What should the audit scope include?

   • AA review of the consensus mechanism's energy consumption.
   • BA review of the smart contract code for reentrancy vulnerabilities.
   • CA check that all nodes are located within the EU, because GDPR requires all personal data to remain in the EU.
   • DAn assessment of how personal data is stored, processed, and transferred, including any cross-border data flows, and whether the blockchain's immutability conflicts with data erasure requirements.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which attack involves creating multiple fake identities to gain disproportionate influence in a blockchain network?

   • AReentrancy attack
   • BPhishing attack
   • CSybil attack
   • DDistributed denial-of-service (DDoS) attack
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which tool is commonly used for static analysis of Solidity smart contracts?

   • ASlither
   • BTruffle
   • CMetamask
   • DGanache
   Reveal Solution Discussion Select an answer first