CBSE Node and Network Security 3 — Questions and Answers
Question 1: A blockchain validator node is targeted by an attacker who controls 51% of peers and delays block propagation to all other honest nodes. What is this strategy called?
- Selfish mining
- Network partitioning with block withholding (Correct answer)
- Fee sniping
- Long-range attack
Correct answer: Network partitioning with block withholding
By partitioning the honest network and withholding new blocks, the attacker can force honest miners onto a stale chain while the attacker's chain grows ahead.
Question 2: Which firewall rule set best protects a Bitcoin full node while still allowing legitimate peer-to-peer traffic on mainnet?
- Allow all inbound TCP, block all UDP
- Allow inbound TCP 8333, block all other inbound; allow all outbound (Correct answer)
- Allow all traffic on port 8333 and 8332 with no restrictions
- Block all inbound and outbound traffic except port 443
Correct answer: Allow inbound TCP 8333, block all other inbound; allow all outbound
Bitcoin P2P runs on TCP 8333; restricting other inbound ports limits attack surface while allowing peers to connect, and blocking RPC port 8332 from inbound prevents remote RPC abuse.
Question 3: What does 'transaction malleability' allow an attacker to do at the network level before a transaction is confirmed?
- Change the transaction amount without invalidating the signature
- Alter the transaction ID (txid) by modifying the scriptSig without changing its validity (Correct answer)
- Double-spend by broadcasting two conflicting transactions
- Replay the same transaction on a forked chain
Correct answer: Alter the transaction ID (txid) by modifying the scriptSig without changing its validity
Transaction malleability lets a third party tweak the scriptSig data, producing a different txid for the same economic transaction, which can confuse tracking systems.
Question 4: A node operator wants to mitigate Sybil attacks in their private blockchain network. Which identity mechanism provides the strongest resistance?
- IP address whitelisting only
- Permissioned membership with certificate-based node identity (e.g., X.509 via a CA) (Correct answer)
- Username/password authentication in the P2P handshake
- Proof-of-work identity tokens
Correct answer: Permissioned membership with certificate-based node identity (e.g., X.509 via a CA)
Certificate-based identity ties each node to a CA-issued credential, making it expensive for an attacker to create unlimited fake identities.
Question 5: Which metric in node monitoring most directly indicates an ongoing eclipse attack against a blockchain node?
- High disk I/O on the block database
- All peer connections resolving to the same ASN or IP subnet (Correct answer)
- Increased transaction processing time
- Low CPU utilization during mining
Correct answer: All peer connections resolving to the same ASN or IP subnet
Eclipse attacks rely on filling the victim's peer table with attacker-controlled nodes, so seeing all peers from a single ASN or narrow IP range is a strong indicator.
Question 6: In a proof-of-stake network, what type of node-level attack attempts to manipulate a validator's local clock to make it sign blocks for a future slot?
- Long-range attack
- Timejacking (Correct answer)
- Grinding attack
- Nothing-at-stake attack
Correct answer: Timejacking
Timejacking shifts the victim node's network-adjusted time by advertising false timestamps from multiple peers, causing it to accept or produce blocks at incorrect times.
Question 7: Which protocol feature in libp2p (used by Ethereum 2.0 and Filecoin) is specifically designed to resist network-level censorship of node discovery?
- Kademlia DHT with peer routing (Correct answer)
- TCP hole punching via TURN relay
- HTTP/2 multiplexing
- WebSocket fallback transport
Correct answer: Kademlia DHT with peer routing
Kademlia DHT distributes peer discovery information across many nodes, making it resilient to censorship because no single node controls the routing table.
CBSE Node and Network Security 3
A blockchain validator node is targeted by an attacker who controls 51% of peers and delays block propagation to all other honest nodes.
What is this strategy called?