CBSE Blockchain Threat Modeling 4

Question 1

A blockchain threat model categorizes a threat as affecting 'availability' of the network. Which specific attack does this BEST describe?

Accepted Answer

A transaction flooding DoS attack that fills the mempool and blocks legitimate transactions

Answer

Transaction flooding is a denial-of-service attack that exhausts mempool capacity, preventing legitimate transactions from being included in blocks.

Question 2

In a blockchain threat model, what role does the 'assume breach' principle play?

Accepted Answer

It designs security controls assuming an attacker has already gained partial access

Answer

The assume breach principle shifts focus to detection, containment, and recovery by designing systems that limit blast radius even after an initial compromise.

Question 3

Which threat to blockchain node software is BEST categorized under the 'Elevation of Privilege' component of STRIDE?

Accepted Answer

A bug in the consensus client allowing a peer to trigger admin RPC calls without authentication

Answer

Elevation of Privilege occurs when an attacker gains capabilities beyond their authorized level, such as triggering privileged RPC calls via a client vulnerability.

Question 4

A threat model for a blockchain wallet identifies seed phrase backup as a critical asset. Which threat to this asset is classified as an 'insider threat'?

Accepted Answer

A malicious wallet developer embedding a seed exfiltration backdoor in the app

Answer

An insider threat originates from a trusted party with privileged access, such as a developer intentionally inserting malicious code to steal seed phrases.

Question 5

Which technique in blockchain threat modeling specifically evaluates whether smart contract state transitions can lead to unintended final states?

Accepted Answer

Formal verification using model checkers

Answer

Formal verification uses mathematical model checkers to exhaustively prove or disprove that all possible smart contract state transitions conform to specified invariants.

(CBSE) Certified Blockchain Security Expert Practice Test

(CBSE) Certified Blockchain Security Expert Practice Test

CBSE Blockchain Threat Modeling 4