Incident Response and Risk Mitigation BDC Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A DeFi protocol has been exploited, and the team is considering whether to attempt a white-hat rescue or let the exploit continue. The protocol has a governance mechanism that requires a 7-day timelock. The attacker is draining funds at a rate of 1% of the total value locked (TVL) per hour. What is the most important consideration?

   • AThe team should focus on communication rather than rescue.
   • BThe team should wait for the attacker to return the funds voluntarily.
   • CThe rescue is not necessary because the attacker will eventually stop.
   • DThe rescue must be executed before the timelock expires, or the attacker will drain a significant portion of the TVL.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A blockchain security analyst is monitoring a DeFi protocol that relies on a decentralized price oracle. The analyst notices a sudden, large price deviation in a token pair that is not reflected in other major exchanges. The deviation lasts for only a few blocks and then reverts. Which type of attack is most likely occurring, and what should the analyst do first?

   • AA governance attack on the oracle's admin key; the analyst should check for unauthorized parameter changes.
   • BA front-running attack on a large trade; the analyst should review the mempool for pending transactions.
   • CA 51% attack on the underlying blockchain; the analyst should monitor for chain reorganization.
   • DOracle manipulation via a flash loan; the analyst should alert the protocol team and recommend pausing dependent functions.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A DeFi protocol is planning to launch a new governance token. The team wants to implement risk mitigation strategies to protect against governance attacks. Which measure is most effective in reducing the risk of a governance attack?

   • AKeep the governance token supply low to increase its value.
   • BAllow any token holder to propose changes without a minimum threshold.
   • CDistribute the governance token widely to increase decentralization.
   • DImplement a time-lock on governance actions and require a multi-sig approval for critical changes.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A cross-chain bridge protocol has been exploited, and the attacker has moved funds across multiple chains using a series of wrapped token swaps. The forensic team needs to trace the funds across different blockchains. Which approach is most effective?

   • ARequest the bridge operator to reverse the transactions on all chains.
   • BUse cross-chain analytics tools that can follow the movement of funds through bridge contracts and map addresses across chains.
   • CAnalyze the attacker's IP address from the bridge's frontend logs.
   • DFocus only on the chain where the exploit occurred and ignore other chains.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A blockchain company operating in the EU experiences a data breach involving personal data stored on-chain in a smart contract. The company must comply with GDPR. What is the most important consideration for their incident response?

   • AThe company must delete the entire blockchain to comply with GDPR.
   • BThe immutability of the blockchain may conflict with the GDPR right to erasure.
   • CGDPR does not apply to blockchain because it is decentralized.
   • DThe company only needs to notify the data protection authority if the breach affects more than 1 million users.
   Reveal Solution Discussion Select an answer first