Incident Response and Risk Mitigation BDC Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A DeFi protocol is considering adding insurance coverage to its risk mitigation strategy. The protocol's treasury is limited, and the team must decide between purchasing insurance from a decentralized insurance provider or allocating the same funds to a larger bug bounty program. Which consideration should be most important in this decision?

   • AThe insurance policy may cover user losses but does not prevent the exploit, while a bug bounty may prevent exploits by incentivizing discovery.
   • BInsurance is required by law for DeFi protocols.
   • CBug bounties are only effective for large protocols with many users.
   • DInsurance is always cheaper than a bug bounty program.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   During forensic analysis of a DeFi exploit, you find that the attacker used a proxy contract to interact with the vulnerable protocol. The proxy's implementation was changed after the attack. What is the most important implication for your investigation?

   • AThe proxy contract's address is sufficient to trace the attack; no further analysis is needed.
   • BThe proxy contract's storage is immutable and cannot be changed.
   • CThe attack cannot be traced because the proxy obscures all on-chain data.
   • DYou must analyze the proxy's historical implementation to understand the exact code that was executed during the attack.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a common compliance obligation for DeFi protocols when a security incident occurs that affects user funds?

   • APaying a ransom to the attacker to recover funds
   • BImmediately shutting down the protocol permanently
   • CNotifying relevant authorities and affected users as required by applicable laws
   • DDeleting all user data to prevent further exposure
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A DeFi protocol has suffered a major exploit, and the team is preparing a post-incident communication plan. The protocol has users in multiple jurisdictions, including the EU and the US. Some regulators may require disclosure, while others do not. What is the best approach to communication?

   • ADelay all communication until legal counsel has reviewed every word, even if it takes weeks.
   • BRelease a detailed report including all transaction details and user addresses to ensure full transparency.
   • CPublish a general public statement that does not include personal data, and provide specific notifications to regulators where required.
   • DOnly communicate with users in jurisdictions that require disclosure, and ignore others.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A DeFi protocol team is designing its risk mitigation strategy. They have a limited budget and want to reduce the likelihood of smart contract exploits while also providing a safety net for users. Which combination of measures best addresses both goals?

   • AConduct regular security audits and run a bug bounty program.
   • BPurchase a large insurance policy and publish a detailed risk disclosure document.
   • CDeploy the protocol on a private blockchain to avoid public attacks.
   • DRely on the community to report bugs through social media.
   Reveal Solution Discussion Select an answer first