CBSE Blockchain Incident Response and Forensics 2 — Questions and Answers
Question 1: A CBSE professional is analyzing a Ethereum exploit. Which tool provides the most detailed transaction-level trace including internal calls?
- Etherscan transaction viewer
- Tenderly or Geth debug_traceTransaction (Correct answer)
- MetaMask activity log
- Hardhat console.log output
Correct answer: Tenderly or Geth debug_traceTransaction
Tools like Tenderly and Geth's debug_traceTransaction expose every opcode-level internal call, enabling deep exploit reconstruction.
Question 2: What forensic artifact should be preserved immediately after discovering a compromised validator node?
- The validator's staking rewards history
- Memory dump, disk image, and network logs before shutdown (Correct answer)
- The node's public key
- The consensus vote history
Correct answer: Memory dump, disk image, and network logs before shutdown
Volatile memory and disk images capture live attacker artifacts that are lost once a system is powered off.
Question 3: Which approach helps attribute an on-chain attacker to a real-world identity during an incident investigation?
- Analyzing the smart contract ABI
- Correlating blockchain addresses with KYC data from centralized exchanges (Correct answer)
- Reviewing the block header timestamp
- Checking the EIP-1559 base fee history
Correct answer: Correlating blockchain addresses with KYC data from centralized exchanges
Centralized exchanges with KYC collect identity data that can be subpoenaed when attackers cash out stolen funds.
Question 4: During a blockchain incident, a responder discovers a malicious contract deployed via a CREATE2 opcode. Why is this significant?
- CREATE2 contracts cannot be audited
- The attacker pre-computed the deployment address to bypass allowlists before deploying malicious code (Correct answer)
- CREATE2 bypasses gas fees
- CREATE2 contracts are invisible to block explorers
Correct answer: The attacker pre-computed the deployment address to bypass allowlists before deploying malicious code
CREATE2 allows deterministic address pre-computation, enabling attackers to whitelist an address before deploying exploit code to it.
Question 5: What is the purpose of a blockchain incident timeline reconstruction?
- To calculate validator uptime
- To establish the sequence of events enabling root cause analysis and legal evidence (Correct answer)
- To optimize gas costs retroactively
- To rewrite the blockchain's history
Correct answer: To establish the sequence of events enabling root cause analysis and legal evidence
A precise timeline maps attacker actions in order, supporting both technical remediation and legal proceedings.
Question 6: A DeFi protocol loses $10M in an exploit. The team considers a 'white hat rescue' by front-running the attacker. What is the primary risk of this approach?
- It increases gas fees for normal users
- It may constitute unauthorized access and expose the team to legal liability (Correct answer)
- It permanently disables the protocol
- It triggers a consensus fork
Correct answer: It may constitute unauthorized access and expose the team to legal liability
Even well-intentioned front-running to rescue funds can be legally ambiguous and may violate the Computer Fraud and Abuse Act (CFAA).
CBSE Blockchain Incident Response and Forensics 2
A CBSE professional is analyzing a Ethereum exploit.
Which tool provides the most detailed transaction-level trace including internal calls?