CCE Security & Risk Management 4 — Questions and Answers
Question 1: What is the main purpose of a bug bounty program in the cryptocurrency ecosystem?
- Reward miners for block discovery
- Incentivize ethical hackers to find and report vulnerabilities (Correct answer)
- Compensate users affected by exchange hacks
- Fund smart contract development
Correct answer: Incentivize ethical hackers to find and report vulnerabilities
Bug bounty programs pay security researchers to responsibly disclose vulnerabilities before malicious actors exploit them.
Question 2: Which risk specifically affects DeFi protocols due to their reliance on external price feeds?
- Regulatory risk
- Oracle manipulation risk (Correct answer)
- Liquidity fragmentation risk
- Network congestion risk
Correct answer: Oracle manipulation risk
Oracle manipulation risk arises when attackers manipulate the price feeds that DeFi protocols rely on to value assets, enabling exploits like flash loan attacks.
Question 3: What is 'key ceremony' in the context of cryptocurrency infrastructure?
- A blockchain consensus ritual for new coin launches
- A formal, witnessed process for generating and distributing cryptographic keys securely (Correct answer)
- An exchange's annual security audit procedure
- A smart contract deployment verification process
Correct answer: A formal, witnessed process for generating and distributing cryptographic keys securely
A key ceremony is a formal, audited procedure where cryptographic keys are generated in a secure, multi-party environment to ensure no single party controls them.
Question 4: What does 'operational security' (OPSEC) mean for a cryptocurrency holder?
- Securing the blockchain network's operating system
- Protecting sensitive information and behaviors that could reveal crypto holdings to adversaries (Correct answer)
- Running a full node for network security
- Auditing smart contract operations
Correct answer: Protecting sensitive information and behaviors that could reveal crypto holdings to adversaries
OPSEC for crypto holders involves minimizing information leakage about wallet addresses, holdings, and security practices to reduce targeting risk.
Question 5: Which regulatory framework most commonly requires cryptocurrency exchanges to implement AML programs in the United States?
- Sarbanes-Oxley Act (SOX)
- Bank Secrecy Act (BSA) (Correct answer)
- Gramm-Leach-Bliley Act (GLBA)
- Securities Exchange Act of 1934
Correct answer: Bank Secrecy Act (BSA)
The Bank Secrecy Act requires US money services businesses, including many crypto exchanges, to implement AML/KYC programs and file SARs.
Question 6: What is the role of a 'time-lock' mechanism in smart contract security?
- Prevents transactions during high network congestion
- Delays execution of sensitive operations, giving time to detect and respond to exploits (Correct answer)
- Locks tokens at a fixed price for a specified period
- Limits transaction frequency to prevent spam
Correct answer: Delays execution of sensitive operations, giving time to detect and respond to exploits
Time-locks impose a mandatory delay before critical functions (like admin upgrades) execute, giving the community time to detect malicious changes.
Question 7: What is the key risk introduced by using a custodial cryptocurrency service?
- Higher blockchain transaction fees
- Counterparty risk — the custodian controls your private keys (Correct answer)
- Slower transaction confirmation times
- Reduced network decentralization
Correct answer: Counterparty risk — the custodian controls your private keys
Custodial services hold users' private keys, meaning users bear counterparty risk if the custodian is hacked, insolvent, or fraudulent.
CCE Security & Risk Management 4
What is the main purpose of a bug bounty program in the cryptocurrency ecosystem?