Incident Response and Risk Mitigation BDC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A DeFi protocol is considering implementing a bug bounty program. They want to maximize the effectiveness of the program. Which approach is most likely to attract high-quality security researchers?

   • AOffer a clear scope, defined reward tiers based on severity, and a transparent disclosure process.
   • BRequire researchers to sign a non-disclosure agreement before participating.
   • COffer a fixed reward for any vulnerability, regardless of severity.
   • DKeep the program secret and only invite a few trusted researchers.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A DeFi protocol is incorporated in a jurisdiction with strict data protection laws. During an incident, the team discovers that personal data was written to the blockchain in a smart contract event. What is the most challenging regulatory issue they face?

   • AThe personal data can be easily deleted by forking the blockchain.
   • BThe personal data is not subject to data protection laws because it is on a public blockchain.
   • CThe personal data cannot be erased or modified due to blockchain immutability, conflicting with data protection rights.
   • DThe personal data is automatically encrypted and therefore exempt from data protection laws.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A blockchain security team is reviewing its incident response plan after a minor incident. They want to improve the plan based on lessons learned. Which action is most aligned with the post-incident activity phase?

   • AImmediately implement a new monitoring tool without reviewing the incident.
   • BDelete all logs and transaction data related to the incident to free up storage.
   • CBlame the individual who missed the initial alert and take disciplinary action.
   • DConduct a post-mortem meeting to identify what went well and what could be improved, and update the incident response plan accordingly.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A DeFi protocol is considering adding a bug bounty program. What is the primary benefit of this mitigation strategy?

   • AIt replaces the need for regular security audits.
   • BIt automatically fixes all discovered vulnerabilities.
   • CIt guarantees that no vulnerabilities will ever be exploited.
   • DIt incentivizes security researchers to find and disclose vulnerabilities before they are exploited.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An attacker exploited a reentrancy vulnerability in a DeFi protocol. You are conducting forensic analysis to trace the attack. Which on-chain data is most important to collect first?

   • AThe private key of the attacker's wallet.
   • BThe protocol's marketing materials.
   • CThe transaction hashes of the exploit and all related internal transactions.
   • DThe attacker's IP address from the protocol's frontend logs.
   Reveal Solution Discussion Select an answer first