CBSE Blockchain Incident Response and Forensics 1

Question 1

What is the first step a blockchain security responder should take when a smart contract exploit is detected on a live network?

Accepted Answer

Immediately pause or upgrade the contract if a circuit breaker exists

Answer

Triggering a circuit breaker or emergency pause is the fastest way to halt further fund loss while preserving forensic state.

Question 2

Which on-chain data source is most valuable for tracing stolen funds after a blockchain hack?

Accepted Answer

Transaction history and event logs on the public ledger

Answer

The immutable public ledger with event logs provides a full audit trail that forensic analysts use to follow stolen assets.

Question 3

A blockchain forensics team identifies a wallet cluster used for money laundering. Which technique links those wallets together?

Accepted Answer

Common-input ownership heuristic

Answer

The common-input ownership heuristic assumes that all inputs in a transaction are controlled by the same entity, allowing wallet clustering.

Question 4

During a post-incident blockchain review, what does an unusually high gas consumption spike in a single block most likely indicate?

Accepted Answer

A potential flash loan or reentrancy attack consuming compute-heavy operations

Answer

Flash loan attacks and reentrancy exploits often cause extreme gas usage in a single transaction or block as complex operations are executed.

Question 5

Which US agency is the primary authority for reporting a major cryptocurrency theft that crosses state lines?

Accepted Answer

FBI / IC3

Answer

The FBI's Internet Crime Complaint Center (IC3) is the primary federal body for reporting internet-enabled financial crimes including crypto theft.

(CBSE) Certified Blockchain Security Expert Practice Test