Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About KPMG hiring for Blockchain roles
KPMG is one of the Big Four professional services networks, providing audit, tax and advisory services. KPMG in India and its global delivery centres support clients with technology consulting, data and analytics, risk advisory and cybersecurity. It hires in India for analysts and consultants in data analytics, governance and risk, IT audit, testing and ERP implementation.
For Blockchain roles, this KPMG practice set focuses most on dApp Development (6), Consensus and Scaling (6), Smart Contract Security (4), Blockchain Fundamentals (3). It has 5 easy, 21 medium, 4 hard questions, so you can start easy and work up to the harder ones.
Company type
Consulting
Headquarters
Amstelveen, Netherlands
Main India offices
Gurugram, Bengaluru, Mumbai, Hyderabad, Pune
KPMG Blockchain interview process
Online assessment or screening test
Technical interview
Managerial or case round
Partner or HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for KPMGStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What is the difference between a soft fork and a hard fork?
A soft fork tightens the rules so that new blocks are still valid for old nodes; it is backward compatible, like Bitcoin's SegWit upgrade. A hard fork changes the rules so that old nodes reject new blocks, so every node must upgrade or the chain splits, as with Ethereum and Ethereum Classic in 2016. Planned network upgrades on Ethereum, such as Dencun and Pectra, are coordinated hard forks that all clients adopt together.
02
What are the basic Foundry commands to create, build, test and work with a project?
curl -L https://foundry.paradigm.xyz | bash && foundryup
forge init my-dapp # new project with src, test, script
forge install OpenZeppelin/openzeppelin-contracts
forge build # compile
forge test -vvv # run tests with traces
forge coverage # coverage report
forge snapshot # gas snapshot
anvil # local node
cast call ADDR 'count()(uint256)' --rpc-url $RPC
Foundry tests are written in Solidity and run fast; Hardhat is the JavaScript or TypeScript alternative with a large plugin ecosystem.
03
How do you compute a function selector and decode calldata with cast?
cast handles ABI work from the command line.
# Function selector
cast sig 'transfer(address,uint256)'
# 0xa9059cbb
# Encode calldata
cast calldata 'transfer(address,uint256)' 0xAbc... 1000000
# Decode calldata from a transaction
cast 4byte-decode 0xa9059cbb000000...
# Decode with a known signature
cast decode-calldata 'transfer(address,uint256)' 0xa9059cbb...
This is useful when checking what a wallet is really asking you to sign.
04
What are front-running and sandwich attacks, and how do you mitigate them?
Pending transactions are public, so bots can copy or outbid them. Front-running is placing a transaction ahead of a victim's, for example buying before a large purchase. A sandwich attack buys before the victim's swap and sells right after, profiting from the price impact. Mitigations include slippage limits and deadlines, commit-reveal schemes, batch auctions, private transaction relays, and design that does not reward ordering, such as using time-weighted prices.
05
What are state channels, such as the Lightning Network?
A state channel locks funds in an on-chain contract or multisig between parties, who then exchange many signed off-chain updates and settle only the final state on-chain. Lightning on Bitcoin links channels into a network so payments route through intermediaries using hashed timelock contracts. Channels give instant, nearly free payments but need participants to be online or use watchtowers, and they lock liquidity, so they suit repeated payments between known parties rather than general smart contracts.
06
You are launching a 10,000-piece NFT collection and fear gas wars and bots. How do you design the mint?
Avoid a first-come public rush. Use an allowlist phase with Merkle proofs or signatures, per-wallet limits, and staggered time slots. Consider a Dutch auction or raffle so price, not gas, decides allocation. Use ERC-721A or efficient batch minting to cut gas. Reveal traits later with Chainlink VRF so bots cannot snipe rare items. Load-test the front-end and RPC, and keep pause functions ready in case something goes wrong.
07
How do you deploy a contract to a Layer 2 testnet with Foundry?
Set the RPC URL and a deployer key, then use forge create or a script, and verify the source on the explorer.
export RPC_URL=https://sepolia.l2-example.org
export PRIVATE_KEY=0x... # testnet key only
forge create src/Counter.sol:Counter \
--rpc-url $RPC_URL --private-key $PRIVATE_KEY --broadcast
# Scripted deploy with verification
forge script script/Deploy.s.sol --rpc-url $RPC_URL \
--broadcast --verify
Use a keystore via cast wallet import instead of raw keys for anything real.
08
A client in India wants to tokenise real estate for fractional ownership. What do you consider?
Regulation comes first: fractional real estate is likely a security or collective investment, so SEBI rules, including those for fractional ownership platforms, apply, and crypto-like tokens are taxed as virtual digital assets at 30 percent with 1 percent TDS. Use a permissioned token with KYC-gated transfers, such as ERC-3643, and a legal SPV that holds the property. Keep title documents off-chain, put hashes on-chain, and plan for rent distribution, transfer restrictions and recovery.
Track on-chain activity in real time: alert on admin actions, large transfers, unusual withdrawal rates, paused states, oracle deviations and failed transactions. Use monitoring services or custom bots reading events, with alerts to on-call channels. Monitor invariants, such as total assets matching total shares, and automate responses like pausing through a guardian. Also watch the front-end, RPC health and DNS for hijacking. Review alerts weekly to reduce noise and test the incident runbook.
EIP-1559 splits the fee into a base fee and a priority fee. The protocol sets the base fee per block from demand: if the previous block was more than half full, it rises up to 12.5 percent, otherwise it falls. The base fee is burned. Users add a priority fee (tip) for the proposer and set maxFeePerGas as their cap. They pay base fee plus tip, never more than the cap, which makes fees more predictable.
11
How do upgradeable contracts work, and how do Transparent and UUPS proxies differ?
A proxy holds the state and delegates every call to an implementation contract whose address is stored in a standard EIP-1967 slot; upgrading means pointing to a new implementation. In the Transparent pattern, upgrade logic lives in the proxy and an admin cannot call implementation functions, which avoids selector clashes. In UUPS, upgrade logic lives in the implementation, making proxies cheaper, but a faulty upgrade can brick it. Both use initialisers instead of constructors and require storage-layout compatibility.
A blockchain is a distributed, append-only ledger where records are grouped into blocks and each block stores the hash of the previous block, forming a chain. Many independent nodes keep a copy and agree on new blocks through a consensus protocol, so no single party controls the data. Changing an old block would change its hash and break every later link, which makes tampering easy to detect. Bitcoin and Ethereum are the best known public examples.
13
How do you read the latest finalized block with ethers.js, and why use it?
Pass the block tag to getBlock. The finalized tag returns the latest block that Proof of Stake has finalised, which cannot be reverted without slashing a third of stake.
import { JsonRpcProvider } from 'ethers';
const provider = new JsonRpcProvider(process.env.RPC_URL);
const latest = await provider.getBlock('latest');
const safe = await provider.getBlock('safe');
const finalized = await provider.getBlock('finalized');
console.log(latest.number - finalized.number); // usually about 64-96
Use finalized for deposits and accounting; use latest for UI updates.
14
Your target users in India have never used crypto wallets. How do you design onboarding?
Hide crypto complexity. Offer login with phone or email using embedded or smart contract wallets, so no seed phrase is needed at first. Sponsor gas with a paymaster so users need no tokens. Show amounts in rupees and plain language, support regional languages, and explain actions in simple terms. Provide account recovery via passkeys or guardians, and let advanced users export to self-custody later. Ensure KYC and tax requirements are clear where money is involved.
15
What happens, step by step, when you send an Ethereum transaction?
The wallet builds the transaction with nonce, to, value, data, gas limit and fee fields, signs it with the private key, and sends it to a node via eth_sendRawTransaction. The node validates and gossips it to other mempools. A block builder includes it, and the proposer publishes the block. Every node executes it in the EVM, updating state and producing a receipt with status, gas used and logs. After about two epochs the block is finalised.
16
How is an Ethereum address derived from a private key?
Start with a random 256-bit private key. Multiply it by the secp256k1 generator point to get a 64-byte uncompressed public key. Take the Keccak-256 hash of that public key and keep the last 20 bytes; that is the address, shown as 0x plus 40 hex characters. EIP-55 adds a mixed-case checksum so typos can be detected. The process is one-way: you cannot get the private key back from the address or public key.
17
What does a smart contract audit process look like?
It starts with scoping: fixed commit, documentation, threat model and test coverage. Auditors run automated tools like Slither and fuzzers, then do manual line-by-line review, checking business logic, access control, economic attacks and integrations. They write findings rated critical, high, medium, low and informational with fixes. The team fixes issues, auditors review the fixes, and a final report is published. Audits reduce risk but do not guarantee safety, so add bug bounties and monitoring.
18
How do you test against real mainnet contracts using a fork?
Anvil or Foundry tests can fork a live chain at a block, so you interact with real tokens and protocols locally.
# Start a local fork
anvil --fork-url $MAINNET_RPC --fork-block-number 21000000
# Or fork inside a test
function setUp() public {
vm.createSelectFork(vm.envString('MAINNET_RPC'), 21000000);
}
# Give yourself tokens or impersonate a whale
deal(address(usdc), alice, 1_000e6);
vm.prank(whale);
Pinning the block number keeps results reproducible and makes RPC caching effective.
19
Your staking validator is missing attestations and losing rewards. How do you investigate?
Check that both execution and consensus clients are synced and peering well, since low peer count or a lagging execution client causes missed duties. Look at system clock sync through NTP, CPU, memory and disk I/O, as slow disks often cause delays. Review client logs and metrics in Grafana, check for pending client upgrades before a fork, and verify network ports are open. Never start a second copy of the same validator key as a fix, because that causes slashing.
20
What are the main components of Hyperledger Fabric?
Hyperledger Fabric is a permissioned enterprise framework. Peers hold the ledger and run chaincode (smart contracts written in Go, Java or JavaScript). Orderers, usually using Raft, sequence transactions into blocks. A Membership Service Provider issues identities through certificate authorities. Channels give separate private ledgers to subsets of members, and private data collections hide data inside a channel. Fabric uses an execute-order-validate flow with endorsement policies instead of mining.
21
How do you store an NFT image on IPFS and use it in your contract?
Upload the image to IPFS using a node or a pinning service, which returns a CID. Create a metadata JSON file whose image field is ipfs://<imageCID>, then upload the metadata folder to get a folder CID. Set the contract's base URI to ipfs://<folderCID>/ so tokenURI(5) resolves to the file for token 5. Pin the content with more than one provider, and use a gateway URL only for display in the front-end.
22
Your dApp's users are paying high gas fees on Ethereum mainnet. How would you choose a Layer 2?
I would compare candidate rollups on security (proof system live, stage of decentralisation, upgrade keys), EVM compatibility so our Solidity code deploys unchanged, ecosystem fit (wallets, oracles, liquidity, bridges our users already use), fees and throughput, and withdrawal experience. I would deploy to testnets first, measure real costs and latency, and check that our dependencies such as Chainlink feeds exist there. Then migrate gradually, keeping L1 contracts for high-value settlement if needed.
23
Why is on-chain randomness insecure, and what should you use instead?
Values like block.timestamp, blockhash or block.prevrandao are visible to or partly controlled by block producers, and any contract can read them in the same transaction and only proceed when the outcome is favourable. So lotteries and NFT trait reveals based on them can be gamed. Use a verifiable random function such as Chainlink VRF, which delivers randomness with a cryptographic proof in a later transaction, or a commit-reveal scheme for simpler cases.
Slashing is a penalty that burns part of a validator's stake and forcibly exits it when it provably breaks protocol rules. On Ethereum the slashable offences are proposing two different blocks in the same slot and making conflicting or surrounding attestations. The penalty grows if many validators are slashed around the same time, which punishes coordinated attacks. Simply being offline is not slashing; it only causes small inactivity penalties. Running the same key on two machines is the most common cause.
25
How does inheritance work in Solidity, including virtual and override?
A contract inherits with is, for example contract Token is ERC20, Ownable. Parent functions that may be changed must be marked virtual, and the child must use override; with several parents you list them, as in override(A, B). Solidity uses C3 linearisation, so the order of the parent list matters, from most base to most derived, and super calls the next contract in that order. Constructors of parents run first in linearised order.
26
What is a signature replay attack and how do you prevent it?
If a contract accepts a signed message to perform an action, an attacker can resubmit the same signature to repeat it, or replay it on another chain or another contract using the same code. Prevent it by including a per-user nonce that increments on use, a deadline, the chain ID and the verifying contract address in the signed data. EIP-712 typed data with a domain separator gives a standard way to include these fields.
27
How should NFT metadata and tokenURI be structured?
tokenURI(id) returns a URI, usually ipfs://<CID>/<id>.json, pointing to JSON that marketplaces read:
{
"name": "Course Certificate #12",
"description": "Completed Blockchain Developer course",
"image": "ipfs://bafy.../12.png",
"attributes": [
{ "trait_type": "Grade", "value": "A" },
{ "trait_type": "Year", "value": 2026 }
]
}
Store images and JSON on IPFS or Arweave rather than a normal server, so metadata cannot silently change or disappear.
28
Explain public, external, internal and private visibility.
public functions can be called externally and internally, and public state variables get an automatic getter. external functions can only be called from outside, or via this.f(), and read arguments directly from calldata. internal functions and variables are available to the contract and contracts that inherit it. private is limited to the defining contract only. Note that private only restricts other contracts; the data is still fully visible on the blockchain to anyone.
29
How do you manage deployer private keys in a CI/CD pipeline?
Never commit keys or put them in plain environment files. For testnets, use CI secret storage with restricted access. For mainnet, avoid hot keys in CI entirely: have CI produce a transaction proposal that signers approve in a multisig, or use a cloud KMS or HSM signer so the key never leaves secure hardware. Separate deployer and admin roles, transfer ownership to a multisig immediately after deployment, and log and review every deployment.
30
How do you keep up with security and cryptography developments in Web3?
I follow a routine. Weekly I read new audit reports and post-mortems of exploits, and I try to reproduce one in Foundry. I track Ethereum Improvement Proposals and upgrade notes, read Solidity release notes, and practise on capture-the-flag platforms such as Ethernaut and Damn Vulnerable DeFi. I also keep a personal notes file of attack patterns. This keeps my knowledge practical rather than just theoretical, and I share summaries with my team.
Tips to crack the KPMG Blockchain interview
Learn basics of IT audit, internal controls and risk frameworks, since advisory roles often combine data with governance work.
Practise structured answers for guesstimates and business problems, explaining assumptions clearly step by step.
Prepare examples of working with stakeholders and meeting deadlines, which are common themes in Big Four interviews.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; KPMG interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the KPMG Blockchain interview?
Candidates usually go through 4 stages: Online assessment or screening test; Technical interview; Managerial or case round; Partner or HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the KPMG Blockchain interview?
This practice set leans on dApp Development (6), Consensus and Scaling (6), Smart Contract Security (4), Blockchain Fundamentals (3). Revise those first, then practise explaining one or two of your own projects end to end, because most KPMG interviewers ask you to walk through real work.
Are these the exact questions asked at KPMG?
No. These are curated practice questions that match the skills and difficulty usually tested in consulting interviews like KPMG's. They are not a leaked or verified list of past questions.
Where does KPMG hire Blockchain professionals in India?
KPMG has large teams in Gurugram, Bengaluru, Mumbai, Hyderabad, Pune. Openings and locations change often, so check the KPMG careers page and filter by city and experience.