Architectural and Design Security Flashcards

A security architect is designing a hybrid blockchain for a defense agency's supply chain. The design includes encrypting peer-to-peer communication with TLS, requiring MFA for node administrators, using firewalls to restrict node access, and implementing role-based access control within smart contracts. This multi-layered approach BEST exemplifies which security design principle?

Answer: Defense in Depth

Defense in Depth is a strategy that involves implementing multiple, redundant layers of security controls. The scenario describes security measures at the network (TLS, firewalls), administrative (MFA), and application/smart contract (RBAC) layers, which is a classic example of this principle.

An enterprise is building a consortium blockchain and needs a secure architecture for managing the private keys of its member organizations. The primary goals are to prevent key compromise from a single point of failure and to allow for key recovery procedures. Which solution best meets these architectural requirements?

Answer: Using a Hardware Security Module (HSM) combined with an M-of-N multi-signature scheme for access.

A Hardware Security Module (HSM) provides a physically secure environment for key generation and signing operations, while an M-of-N multi-signature scheme ensures that multiple authorized parties (M) out of a total group (N) must approve an action. This combination prevents a single point of failure, protects against theft, and enables secure, distributed recovery protocols, making it ideal for enterprise key management.

A DeFi protocol relies on an oracle to provide real-world asset prices to its smart contracts. To ensure architectural robustness and security, which of the following is the most critical design choice to mitigate risks of price manipulation and single points of failure?

Answer: Implementing a decentralized oracle network (DON) that aggregates data from multiple independent nodes and sources.

A decentralized oracle network (DON) is the standard architectural pattern for secure oracle design. It uses multiple independent nodes to fetch data from numerous sources, aggregates the results, and reports a consensus value to the smart contract. This decentralization prevents a single point of failure and makes data manipulation significantly more difficult and expensive.

A development team is architecting a decentralized gaming application that requires thousands of transactions per second with low fees. Deploying directly on a popular Layer 1 blockchain would be prohibitively slow and expensive. Which architectural approach should they adopt to achieve the required performance while retaining the security guarantees of the underlying Layer 1?

Answer: Utilize a Layer 2 scaling solution, such as an optimistic or ZK-rollup.

Layer 2 scaling solutions (like rollups) are designed specifically for this purpose. They process transactions off-chain at high speed and low cost, then bundle or "roll up" the results and post a compressed summary and cryptographic proof back to the secure Layer 1. This provides high throughput while inheriting the security and finality of the main chain.

A government agency wants to build a blockchain-based system for citizens to vote. A critical design requirement is that the system must be able to verify that a person is an eligible voter and has only voted once, all without revealing who the voter is or which candidate they chose. Which architectural component is essential for meeting this privacy requirement?

Answer: Implementation of Zero-Knowledge Proofs (ZKPs) to validate voter eligibility and uniqueness.

Zero-Knowledge Proofs (ZKPs) are a cryptographic method that allows one party to prove to another that a statement is true, without revealing any information beyond the validity of the statement itself. In this scenario, a ZKP could prove a voter is on the eligible list and has not yet voted, without revealing their identity, thus preserving privacy.

During a security design review of a new token vesting smart contract, an auditor notes that the contract has a single `owner` role with unrestricted administrative privileges, including the ability to change vesting schedules, withdraw all tokens, and change ownership. This design most directly violates which core security principle?

Answer: Principle of Least Privilege

The Principle of Least Privilege dictates that an entity should only have the minimum set of permissions necessary to perform its specific function. The `owner` role in this scenario has excessive, centralized power, creating a significant security risk. A better design would separate these powerful functions into different roles or require a multi-signature consensus to adhere to least privilege.