CBSE Blockchain Incident Response and Forensics 1 — Questions and Answers
Question 1: What is the first step a blockchain security responder should take when a smart contract exploit is detected on a live network?
- Immediately pause or upgrade the contract if a circuit breaker exists (Correct answer)
- Redeploy the contract to a new address
- Notify all token holders via email
- Delete the contract bytecode from the chain
Correct answer: Immediately pause or upgrade the contract if a circuit breaker exists
Triggering a circuit breaker or emergency pause is the fastest way to halt further fund loss while preserving forensic state.
Question 2: Which on-chain data source is most valuable for tracing stolen funds after a blockchain hack?
- Mempool pending transactions
- Transaction history and event logs on the public ledger (Correct answer)
- Validator private keys
- Off-chain database backups
Correct answer: Transaction history and event logs on the public ledger
The immutable public ledger with event logs provides a full audit trail that forensic analysts use to follow stolen assets.
Question 3: A blockchain forensics team identifies a wallet cluster used for money laundering. Which technique links those wallets together?
- Zero-knowledge proof analysis
- Common-input ownership heuristic (Correct answer)
- Merkle proof verification
- Schnorr signature aggregation
Correct answer: Common-input ownership heuristic
The common-input ownership heuristic assumes that all inputs in a transaction are controlled by the same entity, allowing wallet clustering.
Question 4: During a post-incident blockchain review, what does an unusually high gas consumption spike in a single block most likely indicate?
- A network-wide software upgrade
- A potential flash loan or reentrancy attack consuming compute-heavy operations (Correct answer)
- Normal validator block proposal
- A routine token airdrop
Correct answer: A potential flash loan or reentrancy attack consuming compute-heavy operations
Flash loan attacks and reentrancy exploits often cause extreme gas usage in a single transaction or block as complex operations are executed.
Question 5: Which US agency is the primary authority for reporting a major cryptocurrency theft that crosses state lines?
- CISA
- FBI / IC3 (Correct answer)
- FTC
- SEC only
Correct answer: FBI / IC3
The FBI's Internet Crime Complaint Center (IC3) is the primary federal body for reporting internet-enabled financial crimes including crypto theft.
Question 6: What is chain-of-custody in the context of blockchain forensics?
- The sequence of block validators
- Documented handling of digital evidence ensuring integrity from collection to court (Correct answer)
- The order in which nodes sync the ledger
- A multi-sig approval workflow
Correct answer: Documented handling of digital evidence ensuring integrity from collection to court
Chain-of-custody documentation ensures digital evidence has not been tampered with and is admissible in legal proceedings.
CBSE Blockchain Incident Response and Forensics 1
What is the first step a blockchain security responder should take when a smart contract exploit is detected on a live network?