CBSA - Certified Blockchain Solution Architect Blockchain Security and Privacy Questions and Answers — Questions and Answers
Question 1: A blockchain solution for a consortium of banks requires that the details of a transaction (sender, receiver, amount) be verifiable by network participants without revealing the actual information to the public. Which cryptographic method is MOST suitable for achieving this specific privacy requirement?
- Homomorphic Encryption
- Zero-Knowledge Proofs (ZKPs) (Correct answer)
- Ring Signatures
- Public-Key Cryptography
Correct answer: Zero-Knowledge Proofs (ZKPs)
Zero-Knowledge Proofs (ZKPs) allow a party (the prover) to prove to another party (the verifier) that a statement is true, without revealing any information beyond the validity of the statement itself. This is ideal for verifying transactions confidentially.
Question 2: A solution architect is designing a decentralized application on a public blockchain where a smart contract handles financial agreements. A critical security concern is preventing an attacker from repeatedly calling a withdrawal function before the contract's state (e.g., the user's balance) is updated. Which of the following vulnerabilities does this scenario describe?
- Integer Overflow
- Timestamp Dependence
- Reentrancy Attack (Correct answer)
- Unchecked External Call
Correct answer: Reentrancy Attack
A reentrancy attack occurs when an external call is made to another contract that then calls back into the original contract before its state is updated. This allows the attacker to repeatedly execute a function, such as `withdraw()`, to drain funds.
Question 3: Which of the following represents the most significant threat to the integrity of a Proof-of-Work (PoW) blockchain, where a single entity or group could potentially reverse transactions and prevent new ones from being confirmed?
- Sybil Attack
- Denial-of-Service (DoS) Attack
- Eclipse Attack
- 51% Attack (Correct answer)
Correct answer: 51% Attack
A 51% attack occurs when a single entity or group gains control of more than 50% of the network's mining hash rate. This majority control allows them to manipulate the blockchain by creating a fraudulent chain of transactions, reversing recent transactions (double-spending), and preventing other miners from confirming legitimate transactions.
Question 4: When architecting a private, permissioned blockchain solution for supply chain management, what is the most effective initial measure to prevent unauthorized organizations from joining the network and accessing sensitive data?
- Implementing Zero-Knowledge Proofs for all transactions.
- Enforcing strict on-chain governance rules.
- Establishing a robust Identity and Access Management (IAM) framework. (Correct answer)
- Encrypting all data stored on the ledger.
Correct answer: Establishing a robust Identity and Access Management (IAM) framework.
In a permissioned blockchain, controlling who can participate is fundamental. An Identity and Access Management (IAM) framework, including measures like Public Key Infrastructure (PKI) and membership services, ensures that only vetted and authorized entities can join the network, read the ledger, or submit transactions.
Question 5: A developer writes a smart contract function that sends Ether to an external address. The code proceeds with updating internal state variables immediately after the `send()` or `transfer()` call, without checking if the call was successful. This practice makes the contract vulnerable to which type of attack?
- Reentrancy
- Access Control Vulnerabilities
- Unchecked External Calls (Correct answer)
- Integer Underflow
Correct answer: Unchecked External Calls
External calls in smart contracts can fail for various reasons. If the contract does not verify the return value of an external call, it might proceed with its logic assuming the call was successful when it was not. This can lead to an inconsistent state and potential exploits. The best practice is to check the boolean return value of such calls.
Question 6: A solution architect is evaluating privacy-enhancing technologies. One option involves a cryptographic signature scheme where a transaction can be signed by one member of a group, but an external observer can only verify that the signature came from the group, not which specific member signed it. What is this technology called?
- Stealth Addresses
- Confidential Transactions
- Ring Signatures (Correct answer)
- Shamir's Secret Sharing
Correct answer: Ring Signatures
Ring signatures provide anonymity by allowing a member of a group (a 'ring') of possible signers to produce a signature on behalf of the group, without revealing which member generated the signature. This obfuscates the origin of the transaction.
CBSA - Certified Blockchain Solution Architect Blockchain Security and Privacy Questions and Answers
A blockchain solution for a consortium of banks requires that the details of a transaction (sender, receiver, amount) be verifiable by network participants without revealing the actual information to the public.
Which cryptographic method is MOST suitable for achieving this specific privacy requirement?