CCE Security & Risk Management 5 — Questions and Answers
Question 1: What is a 'flash loan attack' in DeFi?
- Stealing validator rewards in a single block
- Exploiting uncollateralized loans to manipulate markets and drain protocols within one transaction (Correct answer)
- Rapidly minting tokens to dilute supply
- Using high-frequency bots to front-run DEX trades
Correct answer: Exploiting uncollateralized loans to manipulate markets and drain protocols within one transaction
Flash loans allow uncollateralized borrowing within a single transaction; attackers use them to manipulate prices or exploit vulnerabilities and return the loan atomically.
Question 2: Which practice helps protect against supply chain attacks on cryptocurrency software?
- Using only closed-source wallet software
- Verifying software checksums and cryptographic signatures before installation (Correct answer)
- Disabling automatic updates for all crypto tools
- Storing crypto only on mobile devices
Correct answer: Verifying software checksums and cryptographic signatures before installation
Verifying SHA-256 checksums and developer PGP signatures confirms that downloaded software hasn't been tampered with in the distribution chain.
Question 3: What is 'Miner Extractable Value' (MEV) and why is it a security concern?
- Profits miners earn from block rewards, causing centralization risk
- Value miners or validators extract by reordering, inserting, or censoring transactions for profit (Correct answer)
- Energy costs that reduce miner profitability over time
- Revenue generated from transaction fees on smart contracts
Correct answer: Value miners or validators extract by reordering, inserting, or censoring transactions for profit
MEV allows block producers to profit by reordering or inserting transactions, creating unfair advantages and potentially harming regular users through sandwich attacks.
Question 4: What security vulnerability does a 'backdoored' random number generator (RNG) introduce in cryptocurrency?
- Slower transaction validation speeds
- Predictable private keys that attackers can compute without brute force (Correct answer)
- Reduced entropy in consensus algorithms
- Increased blockchain fork frequency
Correct answer: Predictable private keys that attackers can compute without brute force
A backdoored RNG produces seemingly random but actually predictable outputs, allowing the backdoor creator to derive private keys generated using that RNG.
Question 5: Which control best mitigates the risk of an insider threat at a cryptocurrency exchange?
- Requiring all staff to use the same admin account
- Implementing separation of duties and privileged access management (Correct answer)
- Allowing developers direct production database access
- Using a single custodian for all private keys
Correct answer: Implementing separation of duties and privileged access management
Separation of duties ensures no single employee can complete a sensitive action alone, while privileged access management limits and logs elevated access.
Question 6: What is 'address poisoning' in cryptocurrency?
- Adding malicious code to a smart contract's address storage
- Sending transactions from look-alike addresses to trick users into copying wrong recipient addresses (Correct answer)
- Blacklisting exchange wallet addresses on the blockchain
- Corrupting address lookup tables in blockchain explorers
Correct answer: Sending transactions from look-alike addresses to trick users into copying wrong recipient addresses
Attackers send tiny transactions from addresses visually similar to a victim's frequent contacts, hoping the victim copies the fake address from their transaction history.
Question 7: Which standard defines best practices for information security management systems (ISMS) applicable to cryptocurrency businesses?
- PCI DSS
- ISO/IEC 27001 (Correct answer)
- NIST SP 800-53
- SOC 2 Type I
Correct answer: ISO/IEC 27001
ISO/IEC 27001 is the internationally recognized standard for establishing, implementing, and maintaining an ISMS, widely adopted by crypto firms to demonstrate security rigor.
CCE Security & Risk Management 5
What is a 'flash loan attack' in DeFi?