Mitigating Blockchain Attacks and Security Practices BFC Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A financial institution uses a blockchain to record transactions and must comply with anti-money laundering (AML) regulations that require transaction monitoring. They want to ensure that transaction data is tamper-evident while allowing authorized auditors to read the data. Which combination of practices best meets these needs?

   • AHash each transaction and store the hash on-chain while keeping raw data in an encrypted off-chain database
   • BStore raw transaction data on a public blockchain without encryption
   • CEncrypt all transaction data with a single symmetric key shared among all participants
   • DUse a private blockchain with no access controls for auditors
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security audit of a smart contract reveals that a function uses `msg.sender` to authorize administrative actions. The auditor recommends changing to a multi-signature wallet. What vulnerability is the auditor most likely trying to mitigate?

   • ATimestamp dependence in randomness
   • BReentrancy in external calls
   • CSingle point of failure in key management
   • DInteger overflow in arithmetic operations
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In a blockchain network, an attacker creates numerous fake nodes to gain disproportionate influence in peer-to-peer communication. Which attack vector is this?

   • A51% attack
   • BSybil attack
   • CReplay attack
   • DEclipse attack
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A blockchain-based payment startup must comply with GDPR when storing customer transaction data. The CTO wants to use a public blockchain for immutability but needs to ensure personal data can be erased upon request. Which approach best satisfies both requirements?

   • AStore only hashed or encrypted personal data on-chain and keep raw data off-chain with deletion capability
   • BUse a private blockchain with a single trusted validator to allow rewriting history
   • CEncrypt personal data with a key held by the customer and store the ciphertext on-chain
   • DAvoid storing any data on-chain and use only off-chain databases
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A financial institution is deploying a blockchain-based settlement system. Regulatory auditors require that private keys be protected against both internal theft and external compromise, and that all key-related activities be logged for audit. Which solution best meets these requirements?

   • ADistribute key shares among employees using Shamir's Secret Sharing, but do not log access.
   • BUse a hot wallet for all transactions and keep a backup on a USB drive in a safe.
   • CStore private keys in a hardware security module (HSM) with strict access controls and enable detailed audit logging of all key operations.
   • DEncrypt private keys with a password and store them on a shared network drive for easy access.
   Reveal Solution Discussion Select an answer first