Free CCFI Practice Questions

Question 1

A decoded Bitcoin SegWit transaction spends two previous outputs worth 0.42000000 BTC and 0.18000000 BTC. Its only new outputs are 0.35000000 BTC and 0.24991640 BTC. The transaction occupies 372 serialized bytes and has a virtual size of 209 vbytes. Which entry correctly records its transaction fee and fee rate?

Accepted Answer

8,360 satoshis; 40 sat/vB

Answer

8,360 satoshis; approximately 22.47 sat/vB

Answer

83,600 satoshis; 400 sat/vB

Answer

836 satoshis; 4 sat/vB

Question 2

A company sends cryptocurrency to the wrong supplier address. A screen recording shows the employee selecting an address from a tiny unsolicited transfer in the wallet's transaction history, then pasting and signing a payment to that exact address. Its first and last characters match the supplier's genuine address, but its middle characters differ. The supplier's invoice was unchanged. Which mechanism best accounts for the misdirected payment?

Accepted Answer

Address poisoning placed a look-alike address in the transaction history.

Answer

Clipboard malware substituted an address after the employee copied it.

Answer

A stolen recovery phrase let an intruder sign the payment independently.

Answer

An altered supplier invoice supplied a fraudulent replacement address.

Question 3

The only key material recovered from a merchant's payment server is a BIP 32 account-level extended public key, or xpub. The server configuration identifies the address type and a receiving branch that uses non-hardened derivation. What can the examiner do with this material alone?

Accepted Answer

Derive receiving addresses and reconstruct their on-chain activity.

Answer

Recover the private keys for addresses already used by customers.

Answer

Sign a verification transaction without transferring a positive amount.

Answer

Derive hardened sibling accounts outside the recovered account branch.

Question 4

A trained seizure team has secured a hardware wallet and the complete recovery material for its spendable Bitcoin. Credible evidence shows that an accomplice elsewhere holds a duplicate recovery seed. The court order permits immediate transfer, required approvals are complete, and a destination controlled exclusively by the agency has been independently verified. Initial evidence documentation is complete. Which action addresses the continuing risk of remote removal?

Accepted Answer

Transfer the funds to the verified agency destination and record the transaction identifiers and custody details.

Answer

Change the hardware wallet's PIN, then seal the device while leaving the funds at their existing addresses.

Answer

Restore the recovered seed on agency hardware, then retain the funds in the same wallet under agency supervision.

Answer

Defer movement until every seized device has been fully imaged, leaving the funds at their existing addresses meanwhile.

Question 5

A standard ERC-20 token contract records wallet O approving address S to spend 75,000 tokens. Two days later, a transaction signed by S successfully calls transferFrom(O, R, 50000), reducing O's balance by 50,000 tokens. Which explanation accounts for that debit without requiring theft of O's signing key?

Accepted Answer

S exercised O's existing allowance without obtaining a new transaction signature from O.

Answer

The token's Transfer event carries a separate signature from O authorizing the later debit.

Answer

R can withdraw O's tokens whenever S grants R permission to receive them.

Answer

The earlier approval had already moved the approved tokens from O's balance into S's balance.

Question 6

Stolen Bitcoin reaches an exchange deposit address and is credited to customer account K. The exchange then consolidates that deposit with other customers' funds. A near-equal payment leaves its pooled hot wallet shortly afterward. To determine whether account K requested that withdrawal, which evidence would be most probative?

Accepted Answer

The exchange's account ledger entries and linked customer withdrawal requests.

Answer

The first-seen network addresses of nodes relaying the hot-wallet withdrawal.

Answer

The amounts and timestamps of every nearby transaction from that hot wallet.

Answer

The identity documents and account-opening records submitted by customer K.

Question 7

An exchange supplies a transaction CSV. At acquisition, the examiner calculates its SHA-256 digest and records that digest separately in a secured evidence log. Months later, the CSV's digest matches the logged value. A reviewer disputes the accuracy of the exchange's customer labels. What does the matching digest establish about that dispute?

Accepted Answer

It supports file integrity since acquisition, not the truth of the customer labels.

Answer

It validates the labels that formed part of the originally hashed file.

Answer

It establishes that the exchange supplied all transactions relevant to each customer.

Answer

It verifies that the named customers controlled the private keys for the listed addresses.

Question 8

After a Bitcoin chain reorganization, a wallet transaction previously reported as confirmed returns confirmations: -3 from Bitcoin Core's gettransaction command. The walletconflicts field also names another transaction. How should the examiner interpret the negative confirmation value?

Accepted Answer

The payment conflicts with a competing transaction confirmed on the active chain.

Answer

The payment has three confirmations; the minus sign indicates an outgoing payment.

Answer

The payment must wait three more blocks before its timelock permits confirmation.

Answer

The wallet has abandoned the payment, making its inputs available to spend again.

Question 9

Authenticated payment records identify a Bitcoin transaction as a Payjoin between two unrelated parties. The buyer supplied one input; the merchant supplied another from its own wallet. An analyst has merged both input addresses into the buyer's ownership cluster. How should the transaction be treated?

Accepted Answer

Keep the payment in the trace but preserve the independently established input ownerships.

Answer

Retain the buyer-only cluster because the buyer initiated the combined payment transaction.

Answer

Exclude the payment and its downstream transactions until a single owner can be identified.

Answer

Assign both inputs to the merchant because its wallet assembled the payment proposal.

Question 10

An exchange's authenticated ledger records completed BTC purchases and sales between its existing customers. The assets remain in pooled exchange custody, and no customer makes a deposit or withdrawal during the interval. A blockchain search finds no separate transaction for each trade. How should this lack of one-to-one correspondence be interpreted?

Accepted Answer

Customer balances can change through internal ledger entries without a separate Bitcoin transaction for each trade.

Answer

It identifies Lightning as the settlement network, with the completed trades occurring inside off-chain payment channels.

Answer

The trades remain unsettled until the exchange publishes a batch transaction containing each customer's purchase and sale.

Answer

The ledger represents derivative positions rather than BTC holdings because completed spot trades require individual on-chain transfers.

Free CCFI Practice Questions

Domain 1: Introduction to Cryptocurrency

Question 1

Domain 3: Understanding Encryption

Question 2

Domain 4: Understanding Blockchain

Question 3

Domain 5: Bitcoin Transactions

Question 4

Domain 7: Cryptocurrency Wallets

Question 5

Domain 8: Smart Contracts & Tokens

Question 6

Domain 9: Cryptocurrency Investigation Methodologies

Question 7

Domain 11: The Money Trail

Question 8

Domain 12: Identification of Criminal Activity

Question 9

Domain 13: Seizing Coins

Question 10

The rest of the CCFI blueprint

That's 10 of 1,030