CBSA - Certified Blockchain Solution Architect Blockchain Security and Privacy Questions and Answers

Question 1

A blockchain solution for a consortium of banks requires that the details of a transaction (sender, receiver, amount) be verifiable by network participants without revealing the actual information to the public. Which cryptographic method is MOST suitable for achieving this specific privacy requirement?

Accepted Answer

Zero-Knowledge Proofs (ZKPs)

Answer

Zero-Knowledge Proofs (ZKPs) allow a party (the prover) to prove to another party (the verifier) that a statement is true, without revealing any information beyond the validity of the statement itself. This is ideal for verifying transactions confidentially.

Question 2

A solution architect is designing a decentralized application on a public blockchain where a smart contract handles financial agreements. A critical security concern is preventing an attacker from repeatedly calling a withdrawal function before the contract's state (e.g., the user's balance) is updated. Which of the following vulnerabilities does this scenario describe?

Accepted Answer

Reentrancy Attack

Answer

A reentrancy attack occurs when an external call is made to another contract that then calls back into the original contract before its state is updated. This allows the attacker to repeatedly execute a function, such as `withdraw()`, to drain funds.

Question 3

Which of the following represents the most significant threat to the integrity of a Proof-of-Work (PoW) blockchain, where a single entity or group could potentially reverse transactions and prevent new ones from being confirmed?

Accepted Answer

51% Attack

Answer

A 51% attack occurs when a single entity or group gains control of more than 50% of the network's mining hash rate. This majority control allows them to manipulate the blockchain by creating a fraudulent chain of transactions, reversing recent transactions (double-spending), and preventing other miners from confirming legitimate transactions.

Question 4

When architecting a private, permissioned blockchain solution for supply chain management, what is the most effective initial measure to prevent unauthorized organizations from joining the network and accessing sensitive data?

Accepted Answer

Establishing a robust Identity and Access Management (IAM) framework.

Answer

In a permissioned blockchain, controlling who can participate is fundamental. An Identity and Access Management (IAM) framework, including measures like Public Key Infrastructure (PKI) and membership services, ensures that only vetted and authorized entities can join the network, read the ledger, or submit transactions.

Question 5

A developer writes a smart contract function that sends Ether to an external address. The code proceeds with updating internal state variables immediately after the `send()` or `transfer()` call, without checking if the call was successful. This practice makes the contract vulnerable to which type of attack?

Accepted Answer

Unchecked External Calls

Answer

External calls in smart contracts can fail for various reasons. If the contract does not verify the return value of an external call, it might proceed with its logic assuming the call was successful when it was not. This can lead to an inconsistent state and potential exploits. The best practice is to check the boolean return value of such calls.

(CBSA) Certified Blockchain Solution Architect Practice Test

(CBSA) Certified Blockchain Solution Architect Practice Test

CBSA - Certified Blockchain Solution Architect Blockchain Security and Privacy Questions and Answers