CCI - Certified Cryptocurrency Investigator Blockchain Forensics and Analysis Questions and Answers

Question 1

An investigator is analyzing a series of Bitcoin transactions related to a darknet market seizure.
They are using a blockchain analysis tool to trace the flow of funds.
The investigator groups multiple addresses that are likely controlled by the same entity based on their transactional patterns.
What is this specific forensic technique called?

Accepted Answer

Clustering

Answer

Address Attribution

Answer

Taint Analysis

Answer

Smart Contract Analysis

Question 2

During the execution of a search warrant, a Certified Cryptocurrency Investigator discovers a small, USB-like device. The suspect claims it is a simple storage drive. However, the investigator suspects it is a hardware wallet. Which of the following is the MOST critical piece of information to obtain from the suspect to access the funds associated with this device?

Accepted Answer

The PIN or passphrase for the device

Answer

The public address of the wallet

Answer

The make and model of the device

Answer

A list of recent transaction hashes

Question 3

Which of the following BEST describes the primary function of blockchain analysis platforms like Chainalysis, Elliptic, or TRM Labs in a forensic investigation?

Accepted Answer

To provide real-time risk scoring and trace the flow of funds across blockchains. [2]

Answer

To seize and secure cryptocurrency from suspect wallets.

Answer

To execute smart contracts for recovering stolen assets.

Answer

To create new cryptocurrency wallets for undercover operations.

Question 4

An investigator is examining the key differences between how Bitcoin and Ethereum record transactions for a fraud case. They note that Bitcoin transactions involve consuming previous outputs to create new ones, making it resemble a cash transaction. What is this model called?

Accepted Answer

Unspent Transaction Output (UTXO) Model

Answer

Proof-of-Stake Model

Answer

Account-Based Model

Answer

State Channel Model

Question 5

A Certified Cryptocurrency Investigator is presenting evidence in a money laundering case. They need to explain how the suspect attempted to obscure the trail of stolen funds. The suspect sent their cryptocurrency to a service that pooled their funds with those of many other users before distributing them to new, clean addresses. What is this anonymization technique known as?

Accepted Answer

Mixing (or Tumbling)

Answer

Chain Hopping

Answer

Forking

Answer

Airdropping

Question 6

While examining a suspect's laptop, an investigator finds a text file containing a list of 24 random words. The investigator immediately recognizes this as a potentially critical piece of evidence. What is the most likely function of this list of words in the context of a cryptocurrency investigation?

Accepted Answer

A seed phrase used to restore a cryptocurrency wallet. [3, 4]

Answer

A password list for various online exchanges.

Answer

A list of usernames for darknet market accounts.

Answer

A brain wallet encryption key.