CBSA Security & Compliance 2 — Questions and Answers
Question 1: Which cryptographic technique allows a party to prove knowledge of a secret without revealing the secret itself, commonly used in blockchain privacy solutions?
- Homomorphic encryption
- Zero-knowledge proofs (Correct answer)
- Threshold signatures
- Merkle proofs
Correct answer: Zero-knowledge proofs
Zero-knowledge proofs enable one party to prove to another that a statement is true without conveying any additional information beyond the validity of the statement.
Question 2: In a permissioned blockchain, which access control model assigns permissions based on a user's role within the organization?
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Role-Based Access Control (RBAC)
RBAC assigns permissions to roles rather than individuals, and users are granted permissions by being assigned to appropriate roles.
Question 3: What is the primary purpose of a Certificate Revocation List (CRL) in a blockchain PKI infrastructure?
- To list all valid certificates issued by the CA
- To enumerate certificates that have been invalidated before expiry (Correct answer)
- To store public keys of all network participants
- To record the certificate issuance history
Correct answer: To enumerate certificates that have been invalidated before expiry
A CRL is a list maintained by a Certificate Authority that contains certificates which have been revoked and should no longer be trusted.
Question 4: Which Hyperledger Fabric feature allows organizations to keep certain transaction data visible only to specific channel members?
- Gossip protocol
- Private data collections (Correct answer)
- State database encryption
- Endorsement policies
Correct answer: Private data collections
Private data collections in Hyperledger Fabric allow a subset of organizations to store and transact with data that is kept private from other channel members.
Question 5: When designing a blockchain solution for HIPAA compliance, which requirement is most critical regarding patient data stored on-chain?
- Data must be stored in plaintext for auditability
- PHI should never be stored directly on the blockchain (Correct answer)
- All nodes must be located within the United States
- Patient consent must be recorded as a smart contract
Correct answer: PHI should never be stored directly on the blockchain
HIPAA's minimum necessary standard and security requirements mean that Protected Health Information (PHI) should not be stored directly on-chain; instead, hashes or references should be used.
Question 6: What type of attack involves an adversary gaining control of more than half of a blockchain network's mining or validation power?
- Sybil attack
- 51% attack (Correct answer)
- Eclipse attack
- Double-spend attack
Correct answer: 51% attack
A 51% attack occurs when a single entity controls the majority of the network's consensus power, enabling them to manipulate transaction ordering and potentially reverse transactions.
Question 7: In blockchain security, what does the term 'front-running' refer to?
- Deploying smart contracts before security audits complete
- Exploiting knowledge of pending transactions to gain unfair advantage (Correct answer)
- Bypassing transaction validation by submitting invalid blocks
- Using faster hardware to mine blocks ahead of other nodes
Correct answer: Exploiting knowledge of pending transactions to gain unfair advantage
Front-running occurs when a party observes a pending transaction in the mempool and submits their own transaction with higher fees to be processed first, exploiting that foreknowledge for profit.
CBSA Security & Compliance 2
Which cryptographic technique allows a party to prove knowledge of a secret without revealing the secret itself, commonly used in blockchain privacy solutions?