CCA Security & Risk Analysis 2 — Questions and Answers
Question 1: Which attack vector specifically targets cryptocurrency users by redirecting them to a fake exchange website through DNS manipulation?
- Phishing
- DNS spoofing (Correct answer)
- BGP hijacking
- Sybil attack
Correct answer: DNS spoofing
DNS spoofing (cache poisoning) redirects users to malicious sites by corrupting DNS resolver caches with fraudulent records.
Question 2: In a 51% attack on a proof-of-work blockchain, what is the primary capability the attacker gains?
- Stealing funds from arbitrary wallets
- Double-spending previously confirmed transactions (Correct answer)
- Forging digital signatures
- Decrypting private keys from the blockchain
Correct answer: Double-spending previously confirmed transactions
A majority hashrate attacker can reorganize the chain and reverse recently confirmed transactions to double-spend coins.
Question 3: What is the primary risk associated with a cryptocurrency exchange holding user funds in a single omnibus hot wallet?
- Increased transaction fees
- Concentration risk enabling large-scale theft (Correct answer)
- Reduced liquidity for withdrawals
- Non-compliance with KYC regulations
Correct answer: Concentration risk enabling large-scale theft
A single omnibus hot wallet concentrates all user funds in one target, making a single compromise catastrophic.
Question 4: Which risk management framework is most commonly adapted for assessing cybersecurity risks in cryptocurrency custody operations?
- COSO ERM
- NIST Cybersecurity Framework (Correct answer)
- Basel III
- SOX Section 404
Correct answer: NIST Cybersecurity Framework
The NIST Cybersecurity Framework provides identify, protect, detect, respond, and recover functions directly applicable to crypto custody security.
Question 5: A DeFi protocol's smart contract has an unchecked external call that allows reentrancy. Which audit finding category does this fall under?
- Informational
- Low severity
- Medium severity
- Critical severity (Correct answer)
Correct answer: Critical severity
Reentrancy vulnerabilities are classified as critical because they can drain all funds from a contract, as demonstrated by the DAO hack.
Question 6: What does the term 'slippage risk' refer to in the context of decentralized exchange (DEX) trading?
- Risk of private key exposure during a trade
- Difference between expected and actual execution price due to liquidity changes (Correct answer)
- Risk of a smart contract pausing trades mid-execution
- Loss of funds due to incorrect wallet address entry
Correct answer: Difference between expected and actual execution price due to liquidity changes
Slippage risk is the price difference between when a trade is submitted and when it executes, especially severe in low-liquidity pools.
Question 7: In cryptocurrency auditing, what is 'address reuse' primarily a risk to?
- Transaction throughput and network congestion
- User privacy and potentially key security through reduced entropy (Correct answer)
- Regulatory compliance under FATF travel rule
- Smart contract gas optimization
Correct answer: User privacy and potentially key security through reduced entropy
Address reuse links transactions together on the public ledger, degrading privacy and exposing spending patterns to blockchain analysis.
CCA Security & Risk Analysis 2
Which attack vector specifically targets cryptocurrency users by redirecting them to a fake exchange website through DNS manipulation?