CBSE Enterprise Blockchain Security 3 — Questions and Answers
Question 1: In enterprise blockchain security audits, what does 'front-running' refer to?
- Deploying a smart contract before its audit is complete
- Exploiting knowledge of pending transactions to gain unfair advantage (Correct answer)
- Running a node with outdated software before patching
- Forking the chain to revert disputed transactions
Correct answer: Exploiting knowledge of pending transactions to gain unfair advantage
Front-running occurs when an actor observes a pending transaction in the mempool and submits their own transaction with a higher fee to be processed first.
Question 2: A smart contract written in Solidity uses the pattern 'transfer()' instead of 'call()' for ETH transfers. What security benefit does this provide?
- It allows the recipient contract to execute arbitrary callback logic
- It forwards exactly 2300 gas, preventing reentrancy in fallback functions (Correct answer)
- It bypasses the gas limit entirely for trusted recipients
- It encrypts the transfer amount before broadcasting
Correct answer: It forwards exactly 2300 gas, preventing reentrancy in fallback functions
The 2300 gas stipend forwarded by transfer() is insufficient for the recipient to perform state-changing calls, effectively blocking reentrancy attacks.
Question 3: Which NIST framework publication is most directly applicable to evaluating cryptographic controls in an enterprise blockchain system?
- NIST SP 800-53
- NIST SP 800-57 (Correct answer)
- NIST SP 800-137
- NIST CSF 2.0
Correct answer: NIST SP 800-57
NIST SP 800-57 provides recommendations for key management, which is foundational to the cryptographic integrity of any blockchain system.
Question 4: An attacker gains access to the private key of an ordering node in Hyperledger Fabric. What is the most severe immediate consequence?
- Reading all past encrypted chaincode data
- Injecting arbitrary transaction ordering and censoring transactions (Correct answer)
- Deleting peer ledger data remotely
- Revoking all MSP certificates in the channel
Correct answer: Injecting arbitrary transaction ordering and censoring transactions
The ordering service controls transaction sequencing; a compromised orderer key allows an attacker to manipulate ordering, censor transactions, or create forks.
Question 5: What is the purpose of a 'time-lock' mechanism in enterprise blockchain smart contracts?
- Preventing nodes from synchronizing before a scheduled update
- Delaying the execution of critical functions to allow governance review (Correct answer)
- Encrypting contract state until a future block height
- Limiting the maximum transaction fee during peak periods
Correct answer: Delaying the execution of critical functions to allow governance review
Time-locks introduce a mandatory delay before sensitive actions execute, giving stakeholders a window to detect and respond to malicious proposals.
Question 6: During a penetration test of an enterprise Ethereum node, a tester finds the JSON-RPC port (8545) is publicly accessible. What is the highest-severity attack this enables?
- Reading unencrypted block headers
- Calling eth_sendTransaction to drain unlocked accounts (Correct answer)
- Enumerating connected peer IP addresses
- Flooding the mempool with low-fee transactions
Correct answer: Calling eth_sendTransaction to drain unlocked accounts
An exposed JSON-RPC endpoint with unlocked accounts allows an attacker to sign and broadcast transactions without knowing the private key.
Question 7: Which key management practice is considered the enterprise gold standard for protecting blockchain signing keys in production?
- Storing keys as environment variables in containerized workloads
- Using Hardware Security Modules (HSMs) with FIPS 140-2 Level 3 certification (Correct answer)
- Encrypting key files with bcrypt and storing in a shared file system
- Rotating keys daily using a custom key derivation function
Correct answer: Using Hardware Security Modules (HSMs) with FIPS 140-2 Level 3 certification
FIPS 140-2 Level 3 HSMs provide tamper-evident physical protection and ensure private keys never leave the secure boundary in plaintext.
CBSE Enterprise Blockchain Security 3
In enterprise blockchain security audits, what does 'front-running' refer to?