CCE Security & Risk Management 3 — Questions and Answers
Question 1: What is an 'eclipse attack' in the context of blockchain networks?
- Flooding a node with fake peers to isolate it from the honest network (Correct answer)
- Overloading a consensus node with duplicate transactions
- Stealing validator keys during network downtime
- Exploiting smart contract reentrancy vulnerabilities
Correct answer: Flooding a node with fake peers to isolate it from the honest network
In an eclipse attack, the attacker surrounds a target node with malicious peers, cutting it off from legitimate network information.
Question 2: Which cryptographic scheme is considered most vulnerable to future quantum computing attacks?
- SHA-256 hashing
- Elliptic Curve Digital Signature Algorithm (ECDSA) (Correct answer)
- AES-256 symmetric encryption
- BLAKE2 hashing
Correct answer: Elliptic Curve Digital Signature Algorithm (ECDSA)
Shor's algorithm running on a sufficiently powerful quantum computer could break ECDSA by solving the discrete logarithm problem, exposing private keys.
Question 3: What does the term 'cold storage' mean in cryptocurrency security?
- Storing crypto in a freezing-temperature data center
- Keeping private keys on devices never connected to the internet (Correct answer)
- Using exchange cold wallets with delayed withdrawals
- Encrypting wallets with low-temperature algorithms
Correct answer: Keeping private keys on devices never connected to the internet
Cold storage refers to keeping private keys completely offline (hardware wallets, paper wallets) to protect against remote hacking.
Question 4: A reentrancy attack exploits which vulnerability in smart contracts?
- Weak randomness generation
- A function that calls an external contract before updating its own state (Correct answer)
- Unprotected admin access functions
- Integer overflow in token balances
Correct answer: A function that calls an external contract before updating its own state
Reentrancy attacks (as in the 2016 DAO hack) exploit contracts that send ETH to external addresses before updating internal balance state, allowing repeated recursive withdrawals.
Question 5: What is the primary goal of a Know Your Customer (KYC) process at cryptocurrency exchanges?
- Improve blockchain transaction speeds
- Verify user identity to prevent money laundering and fraud (Correct answer)
- Reduce trading fees for verified users
- Enable anonymous peer-to-peer transactions
Correct answer: Verify user identity to prevent money laundering and fraud
KYC verifies user identities to comply with AML regulations and prevent illicit use of the platform.
Question 6: Which type of wallet is most suitable for storing a large long-term cryptocurrency position securely?
- Exchange hot wallet
- Mobile wallet with biometric lock
- Air-gapped hardware wallet (Correct answer)
- Browser extension wallet
Correct answer: Air-gapped hardware wallet
An air-gapped hardware wallet never connects to the internet, minimizing attack vectors for large, long-term holdings.
Question 7: What is 'dusting attack' in cryptocurrency?
- Sending tiny amounts of crypto to wallets to trace and de-anonymize owners (Correct answer)
- Overloading a wallet app with spam transactions
- Stealing dust-sized balances left in empty wallets
- Corrupting blockchain data with micro-transactions
Correct answer: Sending tiny amounts of crypto to wallets to trace and de-anonymize owners
Dusting attacks send microscopic amounts of crypto to many addresses, then use transaction graph analysis to cluster and identify wallet owners.
CCE Security & Risk Management 3
What is an 'eclipse attack' in the context of blockchain networks?