Blockchain Security Training Network & Node Security 3 — Questions and Answers
Question 1: A validator node's signing keys are stored on the same internet-facing server that runs the public RPC. What is the safer design?
- Use a separate hardened remote signer or HSM (Correct answer)
- Store keys in the RPC config file
- Email the keys to a backup address
- Keep keys in browser local storage
Correct answer: Use a separate hardened remote signer or HSM
Isolating signing keys in a remote signer or HSM limits exposure if the public-facing node is compromised.
Question 2: What is a key risk of running a validator without slashing protection (anti-double-sign) database?
- Accidental double-signing leading to slashed stake (Correct answer)
- Slower block propagation
- Higher RPC latency
- Loss of peer connections
Correct answer: Accidental double-signing leading to slashed stake
Without anti-slash tracking, a restarted or duplicated validator may sign conflicting blocks and be penalized.
Question 3: Which is the best practice for a validator's high-availability setup?
- Active-passive failover with strict double-sign prevention (Correct answer)
- Two identical active signers running simultaneously
- Running the signer on a shared public node
- Disabling monitoring to save resources
Correct answer: Active-passive failover with strict double-sign prevention
Active-passive with double-sign protection avoids the slashing risk of two live signers.
Question 4: A node operator notices abnormal CPU and bandwidth from a single peer flooding invalid transactions. What is this?
- A denial-of-service / resource-exhaustion attack (Correct answer)
- A normal sync event
- A consensus finality gadget
- A successful TLS handshake
Correct answer: A denial-of-service / resource-exhaustion attack
Flooding invalid data to exhaust CPU/bandwidth is a classic DoS technique against nodes.
Question 5: Which mitigation directly addresses transaction-flood DoS on a node?
- Peer rate-limiting, scoring, and banning misbehaving peers (Correct answer)
- Increasing the block reward
- Removing TLS
- Publishing the RPC keys
Correct answer: Peer rate-limiting, scoring, and banning misbehaving peers
Rate-limiting and reputation scoring let a node throttle or ban peers sending abusive traffic.
Question 6: Why should node operators monitor peer count and chain head height continuously?
- To detect eclipse, partition, or stalled-sync conditions early (Correct answer)
- To increase staking rewards automatically
- To reduce disk usage
- To bypass the firewall
Correct answer: To detect eclipse, partition, or stalled-sync conditions early
Sudden drops in peers or a frozen chain head can indicate isolation or a network attack.
Question 7: What is the security benefit of pinning trusted bootstrap nodes during initial sync?
- Reduces risk of connecting to malicious peers feeding a fake chain (Correct answer)
- Increases token supply
- Disables consensus checks
- Removes the need for updates
Correct answer: Reduces risk of connecting to malicious peers feeding a fake chain
Trusted bootstrap peers help ensure the node joins the honest network rather than an attacker-controlled view.
Blockchain Security Training Network & Node Security 3
A validator node's signing keys are stored on the same internet-facing server that runs the public RPC.
What is the safer design?