ISACA • Blockchain-Fund
Validates foundational knowledge of blockchain technology, covering blockchain history, principles, processes, and infrastructure, as well as real-world applications, implementation challenges, deployment best practices, encryption, and consensus mechanisms.
Questions
599
Duration
120 minutes
Passing Score
65%
Difficulty
FoundationalLast Updated
Feb 2026
The ISACA Blockchain Fundamentals Certificate validates foundational knowledge of blockchain technology across two core domains: Blockchain Concepts (67% of the exam) and Blockchain Usage and Considerations (33%). The credential covers blockchain history, underlying principles, architectural models, infrastructure, interoperability, tokenization, cryptocurrencies, and major blockchain platforms. It is part of ISACA's Certified in Emerging Technology (CET) program, alongside three other emerging technology certificates, and completing all four is a pathway to earning the full CET certification.
The exam blends traditional multiple-choice knowledge questions with performance-based questions set in a virtual lab environment, giving candidates hands-on exposure to core concepts such as encryption, proof-of-work consensus, and blockchain creation. ISACA designed this credential as an entry point for professionals and learners seeking to validate and signal blockchain literacy in a market where enterprise blockchain adoption continues to expand across industries including finance, supply chain, and healthcare.
This certificate is designed for students, recent graduates, and early-career IT professionals who are new to blockchain technology and want to establish foundational credibility in the space. It is equally relevant for business analysts, project managers, auditors, and IT generalists who work adjacent to blockchain initiatives and need a structured understanding of how the technology functions and where it can be applied.
Teams looking to upskill collectively and organizations adopting or evaluating blockchain solutions also represent a core audience. Because there are no prerequisites, anyone with a general interest in blockchain—regardless of prior technical background—can pursue this credential as a first step toward deeper specialization.
There are no formal prerequisites for the Blockchain Fundamentals Certificate. ISACA imposes no minimum experience, prior certifications, or educational requirements. Candidates can register at any time and schedule their exam as early as 48 hours after completing payment.
While no prerequisites are required, familiarity with basic IT concepts—such as networking fundamentals, cryptography basics, and general software architecture—will help candidates engage more effectively with the material. ISACA offers a self-guided online course, a virtual lab package, and a study guide specifically designed to bring candidates up to speed on all tested domains before sitting the exam.
The Blockchain Fundamentals exam is administered as a fully online, remotely proctored, computer-based test with a 2-hour (120-minute) time limit. The exam blends two question formats: standard multiple-choice knowledge questions (each with four answer choices) and performance-based questions delivered within a virtual lab environment. No penalties are applied for incorrect answers—the final score is based solely on the total number of correct responses, so candidates should answer every question.
The passing score is 65% or higher. Candidates are allowed up to four attempts within a rolling 12-month eligibility period. Registration is continuous with no application windows or deadlines, and exam eligibility remains valid for 12 months from the date of registration. The exact total number of questions is not publicly disclosed by ISACA.
Earning the Blockchain Fundamentals Certificate signals verified, vendor-neutral blockchain literacy backed by ISACA—a globally recognized IT governance and assurance body. It is particularly valuable as a credentialing stepping stone: the certificate counts toward ISACA's Certified in Emerging Technology (CET) designation, which also requires certificates in AI Fundamentals, IoT Fundamentals, and Cloud Fundamentals. Holding the CET demonstrates breadth across multiple emerging technology domains, which is increasingly valued by employers building cross-functional digital transformation teams.
For professionals in audit, risk, compliance, and IT governance roles, the credential provides the technical vocabulary needed to assess blockchain projects and communicate with implementation teams. While entry-level blockchain knowledge alone does not command a significant salary premium, it serves as a differentiator for professionals pivoting into blockchain development, consulting, or enterprise architecture roles—where specialized knowledge of platforms, consensus mechanisms, and deployment considerations is directly applicable.
5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 599 questions.
1. A stablecoin protocol maintains a 1 USD peg using algorithmic supply adjustments. When the price exceeds 1.01 USD, the protocol automatically mints new tokens and distributes them to holders. When the price falls below 0.99 USD, the protocol offers bonds redeemable for future tokens at premium rates to reduce supply. What critical vulnerability does this design exhibit? (Select one!)
Explanation
Algorithmic stablecoins without collateral backing face death spiral vulnerability where downward price pressure triggers bond issuance, but if confidence collapses, no buyers purchase bonds, supply cannot contract, selling accelerates, and the peg fails catastrophically. TerraUSD's May 2022 collapse destroying over $40 billion in value demonstrated this exact mechanism. Centralization risk from single organization controlling reserves applies to fiat-backed stablecoins with custodial reserves, not algorithmic designs without reserve backing. Liquidation risk from over-collateralized crypto backing describes crypto-backed stablecoins like DAI where collateral value falls below debt, unrelated to algorithmic supply adjustment mechanisms. Counterparty risk from unaudited fiat bank reserves applies to fiat-backed stablecoins relying on traditional banking, not algorithmic protocols operating purely through smart contracts.
2. A decentralized exchange implements an order matching system where users submit limit orders to a smart contract. An attacker monitors the mempool and observes a large purchase order for Token X at 100 USDC per token. The attacker immediately submits a transaction buying Token X at 99 USDC, then submits another transaction selling Token X at 101 USDC, both with higher gas fees than the original order. What type of attack is this? (Select one!)
Explanation
This describes a sandwich attack, which is a form of front-running where attackers exploit mempool transparency to observe pending transactions and submit transactions with higher gas fees to be ordered before and after the victim's transaction. The attacker's first transaction buys Token X at 99 USDC before the victim's large purchase drives the price up, then the second transaction sells at the inflated price of 101 USDC after the victim's purchase executes, profiting from the victim's price impact. This attack type is categorized as Maximal Extractable Value where miners or validators can reorder transactions for profit. A 51 percent attack requires controlling majority network hash power to reorganize blockchain history, which is unrelated to mempool transaction ordering. Reentrancy attacks exploit contract vulnerabilities where external calls allow recursive function re-entry before state updates, completely different from transaction ordering manipulation. Eclipse attacks isolate nodes by surrounding them with attacker-controlled peers, affecting network topology rather than transaction ordering.
3. A Bitcoin wallet application implements BIP-32 hierarchical deterministic key derivation. The wallet uses the derivation path m/44'/0'/0'/0/5 to generate an address. The user later restores the wallet on a different device using the same 12-word BIP-39 mnemonic seed phrase but without the optional passphrase. Will the restored wallet generate the same address at the same derivation path? (Select one!)
Explanation
BIP-32 hierarchical deterministic wallets derive all keys deterministically from the master seed, which is generated from the BIP-39 mnemonic phrase. The same mnemonic always produces the same master seed, which generates identical child keys at any derivation path regardless of device, software, or location. This deterministic property enables wallet recovery across different devices and software implementations. Devices do not generate new entropy during restoration—they use the provided mnemonic. Derivation paths are part of the wallet's configuration and are restored along with the seed. While different wallet software may use different default derivation paths, providing the same path will always generate the same keys from the same seed.
4. A blockchain network experiences a situation where two miners simultaneously find valid blocks at height 500,123. The network temporarily has two competing chains, each extending from different block 500,123 variants. Three minutes later, a new block is found extending one chain to height 500,124. What is this situation called, and what happens to transactions in the abandoned block? (Select one!)
Explanation
This describes a chain reorganization, a normal occurrence when competing blocks are found simultaneously. When the network receives a longer valid chain, nodes discard the shorter chain's blocks and adopt the longer chain. Transactions from abandoned blocks return to the mempool for inclusion in future blocks unless already included in the winning chain. This is not a hard fork, which requires incompatible protocol changes. Soft forks involve rule tightening, not competing blocks. Double-spend attacks are malicious attempts to reverse confirmed transactions, not natural network behavior during simultaneous block discovery.
5. A decentralized application requires users to approve a smart contract to spend ERC-20 tokens on their behalf for automated trading. The user calls the approve function setting an allowance of 1,000 tokens. What happens if the smart contract attempts to transfer 1,500 tokens using transferFrom? (Select one!)
Explanation
ERC-20 standard requires that transferFrom checks the allowance before execution and reverts the entire transaction if the requested amount exceeds the approved allowance. No tokens are transferred and the transaction consumes gas for the failed attempt. This all-or-nothing behavior prevents partial unauthorized transfers. The allowance mechanism does not automatically increase allowances as this would violate user authorization. ERC-20 does not support partial transfers with refunds. Transactions either succeed completely or revert completely in Ethereum's atomic execution model without partial success states.
One-time access to this exam