Auditing, Testing, and Monitoring in Blockchain Security BDC Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which component is a key part of an incident response plan for a blockchain system?

   • AA predefined procedure for containing and mitigating a security breach
   • BA mechanism to automatically roll back the blockchain to a previous state
   • CA tool to mine new blocks faster
   • DA policy to delete all user data after an attack
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A smart contract has a function that calculates rewards based on user input. The team wants to use property-based testing to uncover edge-case vulnerabilities. Which approach best applies property-based testing?

   • AUse a fuzzer to send random transactions to the contract on the mainnet.
   • BManually review the function for common vulnerabilities and fix any issues found.
   • CWrite a set of fixed test cases with known inputs and expected outputs.
   • DDefine a property that the reward calculation must always satisfy, such as 'reward is non-negative and does not exceed the total pool', and generate random inputs to test it.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A DeFi lending protocol uses a price oracle that aggregates data from a single DEX. An auditor is evaluating the risk of oracle manipulation. Which testing approach would best uncover this vulnerability?

   • AWrite a property-based test that simulates a large price swing from the DEX and checks the protocol's behavior
   • BPerform a manual review of the oracle contract's code
   • CRun a fuzzer that generates random price values and checks for reverts
   • DDeploy the protocol on a testnet and manually trade on the DEX to move the price
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A DeFi protocol has been exploited, and the team needs to respond. The protocol has a governance mechanism that can pause the contract. The team also has a bug bounty program. What is the most appropriate first step in the incident response?

   • AContact the bug bounty program to see if the exploit was reported
   • BActivate the incident response plan, which includes assessing the exploit, pausing the contract if needed, and notifying stakeholders
   • CWait for the governance vote to decide on pausing
   • DImmediately pause the contract to stop further losses
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A blockchain startup is planning to issue a token that may be classified as a security in some jurisdictions. The legal team wants the audit to assess compliance risks. The audit team has limited resources. What should the audit prioritize?

   • APerform a full audit of the blockchain protocol's consensus mechanism.
   • BRecommend that the token be offered only in jurisdictions with no securities laws.
   • CFocus on the technical security of the smart contract, because compliance is a legal matter, not a technical one.
   • DDocument the token's functionality and the jurisdictions where it will be offered, and assess whether the token's features could trigger securities regulations, such as profit-sharing or voting rights.
   Reveal Solution Discussion Select an answer first