Blockchain Security Training Incident Response and Blockchain Forensics 1 — Questions and Answers
Question 1: What is the primary objective of blockchain forensics during a security incident investigation?
- To shut down the blockchain network immediately
- To trace and attribute transactions in order to identify threat actors and support asset recovery (Correct answer)
- To rewrite blockchain history and remove malicious transactions
- To decrypt all private keys associated with suspicious wallets
Correct answer: To trace and attribute transactions in order to identify threat actors and support asset recovery
Blockchain forensics focuses on tracing transaction flows and attributing on-chain activity to identify threat actors and support recovery efforts.
Question 2: Which of the following tools is most commonly used by investigators and law enforcement to trace Bitcoin transactions during a forensic investigation?
- Metasploit
- Chainalysis Reactor (Correct answer)
- Wireshark
- Nessus
Correct answer: Chainalysis Reactor
Chainalysis Reactor is a leading blockchain analytics platform specifically designed to trace, visualize, and attribute cryptocurrency transaction flows.
Question 3: What does 'chain of custody' mean in the context of a blockchain forensic investigation?
- The sequence of blocks linking back to the genesis block
- The documented process of preserving and tracking digital evidence from collection through legal presentation (Correct answer)
- The consensus mechanism used to validate transactions on the network
- The order in which nodes process and relay incoming transactions
Correct answer: The documented process of preserving and tracking digital evidence from collection through legal presentation
Chain of custody documents the handling and transfer of digital evidence to ensure its integrity and admissibility in legal proceedings.
Question 4: When a smart contract exploit is actively occurring, what should be the FIRST step in incident response?
- Immediately publish full vulnerability details to warn the community
- Contact law enforcement and file a report
- Pause or disable the contract if a pause function exists to halt further losses (Correct answer)
- Redeploy the contract immediately with a patched version
Correct answer: Pause or disable the contract if a pause function exists to halt further losses
The first priority is containment — pausing the smart contract stops ongoing exploitation and limits financial damage before remediation begins.
Question 5: Which on-chain data element is most critical for tracing stolen cryptocurrency funds after an incident?
- Block gas limits and miner fee adjustments
- Transaction hashes and wallet address fund flows (Correct answer)
- Mining pool difficulty targets
- Geographic distribution of validator nodes
Correct answer: Transaction hashes and wallet address fund flows
Transaction hashes and wallet address flows create an immutable, traceable record on the public ledger that investigators can follow to map fund movements.
Question 6: In the context of blockchain incident response, what is a 'replay attack'?
- Re-executing a valid transaction from one blockchain on a forked chain where it is also accepted (Correct answer)
- Flooding blockchain nodes with replayed network packets to cause a denial of service
- Repeating failed smart contract calls to drain funds incrementally
- Copying a chain's full transaction history to a test environment for analysis
Correct answer: Re-executing a valid transaction from one blockchain on a forked chain where it is also accepted
A replay attack exploits shared transaction history after a hard fork, allowing attackers to re-broadcast a valid transaction on the new chain to illegitimately move funds.
Question 7: Which NIST publication provides the foundational incident response lifecycle that organizations can adapt for blockchain security incidents?
- NIST SP 800-61 (Computer Security Incident Handling Guide) (Correct answer)
- NIST SP 800-53 (Security and Privacy Controls)
- NIST SP 800-171 (Protecting CUI)
- NIST SP 800-207 (Zero Trust Architecture)
Correct answer: NIST SP 800-61 (Computer Security Incident Handling Guide)
NIST SP 800-61 defines the preparation, detection, containment, eradication, recovery, and post-incident phases that apply directly to blockchain security incident handling.
Blockchain Security Training Incident Response and Blockchain Forensics 1
What is the primary objective of blockchain forensics during a security incident investigation?