CCA Study Guide 2026
Everything you need to pass the CCA exam in one place: the exam format, every topic to study, real practice questions with explanations, flashcards, and full-length practice tests. Free, no sign-up needed.
📋 CCA Exam Format at a Glance
📚 CCA Topics to Study (57)
✍️ Sample CCA Questions & Answers
1. Which control best mitigates the risk of compromised API keys being used to drain a cryptocurrency exchange's hot wallet?
IP allowlisting restricts API key usage to known IP addresses, and withdrawal address whitelisting limits where funds can be sent even if a key is stolen.
2. During a DeFi protocol audit, which finding would be classified as a 'critical' severity vulnerability?
A reentrancy vulnerability enabling total fund drainage is critical because it directly threatens all user assets and can be exploited immediately upon deployment.
3. Which risk category does 'validator centralization' fall under in a Proof-of-Stake blockchain?
Validator centralization creates systemic concentration risk because a small group controlling majority stake can collude to censor transactions or perform 51% attacks.
4. During an exchange audit, the auditor notices customer deposit addresses are reused for multiple clients. What is the primary audit concern?
Reusing deposit addresses across multiple customers means that on-chain data alone cannot identify which customer made a deposit, creating a complete reliance on the exchange's internal records for attribution.
5. In a multi-signature (multisig) transaction audit, what document should an auditor review to verify the required signing threshold?
The redeem script specifies the M-of-N threshold and the participating public keys, making it the authoritative source for multisig verification.
6. Which of the following best describes a 'layering' stage red flag specific to cryptocurrency transactions?
Rapid multi-hop transfers across wallets and chains with no economic rationale are a classic layering technique to distance funds from their illicit origin.