CBSE Blockchain Incident Response and Forensics 2

Question 1

A CBSE professional is analyzing a Ethereum exploit. Which tool provides the most detailed transaction-level trace including internal calls?

Accepted Answer

Tenderly or Geth debug_traceTransaction

Answer

Tools like Tenderly and Geth's debug_traceTransaction expose every opcode-level internal call, enabling deep exploit reconstruction.

Question 2

What forensic artifact should be preserved immediately after discovering a compromised validator node?

Accepted Answer

Memory dump, disk image, and network logs before shutdown

Answer

Volatile memory and disk images capture live attacker artifacts that are lost once a system is powered off.

Question 3

Which approach helps attribute an on-chain attacker to a real-world identity during an incident investigation?

Accepted Answer

Correlating blockchain addresses with KYC data from centralized exchanges

Answer

Centralized exchanges with KYC collect identity data that can be subpoenaed when attackers cash out stolen funds.

Question 4

During a blockchain incident, a responder discovers a malicious contract deployed via a CREATE2 opcode. Why is this significant?

Accepted Answer

The attacker pre-computed the deployment address to bypass allowlists before deploying malicious code

Answer

CREATE2 allows deterministic address pre-computation, enabling attackers to whitelist an address before deploying exploit code to it.

Question 5

What is the purpose of a blockchain incident timeline reconstruction?

Accepted Answer

To establish the sequence of events enabling root cause analysis and legal evidence

Answer

A precise timeline maps attacker actions in order, supporting both technical remediation and legal proceedings.

(CBSE) Certified Blockchain Security Expert Practice Test