CBSA Security & Compliance 4 â Questions and Answers
Question 1: What is 'key ceremony' in the context of blockchain PKI and why is it important?
- A ritual to initialize smart contract deployment on mainnet
- A formal witnessed procedure to generate and secure root CA keys (Correct answer)
- A protocol for exchanging public keys between organizations
- An automated process for rotating node certificates
Correct answer: A formal witnessed procedure to generate and secure root CA keys
A key ceremony is a strictly controlled, witnessed procedure for generating root CA private keys, ensuring accountability and preventing any single party from having unauthorized access.
Question 2: Which type of smart contract audit technique analyzes code without executing it to find potential vulnerabilities?
- Fuzz testing
- Static analysis (Correct answer)
- Dynamic analysis
- Penetration testing
Correct answer: Static analysis
Static analysis examines source code without executing it, using tools to identify patterns associated with known vulnerabilities like reentrancy or integer overflow.
Question 3: In the context of blockchain compliance, what is 'KYC' and why is it relevant?
- Know Your Chainâauditing the full transaction history of a wallet
- Know Your Customerâverifying the identity of participants before onboarding (Correct answer)
- Keep Your Credentialsâmanaging private key storage policies
- Know Your Consensusâvalidating node participation rules
Correct answer: Know Your Customerâverifying the identity of participants before onboarding
KYC (Know Your Customer) is a regulatory requirement for financial institutions to verify the identity of clients to prevent money laundering, fraud, and terrorist financing.
Question 4: What security risk does an 'oracle problem' introduce to smart contract systems?
- Smart contracts cannot process off-chain data natively, creating a trusted data feed dependency (Correct answer)
- Oracle databases are incompatible with blockchain storage formats
- Decentralized networks cannot maintain synchronized time references
- External APIs expose smart contracts to denial-of-service attacks
Correct answer: Smart contracts cannot process off-chain data natively, creating a trusted data feed dependency
The oracle problem arises because smart contracts cannot securely access off-chain data themselves, requiring trusted intermediaries (oracles) that become potential single points of failure or manipulation.
Question 5: When implementing blockchain in a PCI DSS environment, cardholder data (CHD) should be handled by:
- Storing encrypted CHD directly on-chain for auditability
- Keeping CHD off-chain and storing only cryptographic hashes or tokens on-chain (Correct answer)
- Using blockchain as the sole cardholder data environment
- Distributing CHD across all network nodes for redundancy
Correct answer: Keeping CHD off-chain and storing only cryptographic hashes or tokens on-chain
PCI DSS requires strict controls over cardholder data, and since blockchain's distributed nature expands the cardholder data environment to all nodes, CHD should remain off-chain with only references stored on-chain.
Question 6: What is the purpose of a bug bounty program in the context of blockchain security?
- Rewarding miners who find and report empty blocks
- Incentivizing external researchers to responsibly disclose vulnerabilities (Correct answer)
- Compensating auditors for completed smart contract reviews
- Paying node operators to report consensus failures
Correct answer: Incentivizing external researchers to responsibly disclose vulnerabilities
Bug bounty programs offer financial rewards to security researchers who discover and responsibly disclose vulnerabilities, leveraging the broader security community to find issues before malicious actors do.
Question 7: Which attack vector exploits the predictable nature of block timestamps or miner-controlled randomness in smart contracts?
- Timestamp dependency attack (Correct answer)
- Replay attack
- Dust attack
- Long-range attack
Correct answer: Timestamp dependency attack
Timestamp dependency attacks occur when smart contracts use block timestamps as a source of randomness or time-critical logic, since miners have some ability to manipulate timestamps within acceptable ranges.
CBSA Security & Compliance 4
What is 'key ceremony' in the context of blockchain PKI and why is it important?