CFL Electronic Security Forensics 2

Question 1

When forensically examining an electronic access control system, which log entry type is MOST valuable for reconstructing an unauthorized entry timeline?

Accepted Answer

Failed authentication attempts with timestamps

Answer

Failed authentication attempts with timestamps directly document when and how many times unauthorized access was tried, forming the backbone of an entry timeline.

Question 2

A forensic locksmith finds that a magnetic stripe card reader shows evidence of a skimming device having been attached. What physical evidence on the reader housing is MOST indicative of skimmer attachment?

Accepted Answer

Adhesive residue or tool marks around the bezel

Answer

Adhesive residue indicates a device was glued over the reader, and tool marks suggest the bezel was pried to attach a skimmer or tap into internal wiring.

Question 3

Which RFID frequency range is used by most modern commercial access control proximity cards?

Accepted Answer

125 kHz (LF)

Answer

125 kHz low-frequency proximity cards (such as HID Prox and EM4100) remain the most widely deployed standard in legacy commercial access control installations.

Question 4

During a forensic investigation, an electronic lock's audit log shows a valid credential was used at 2:47 AM but the assigned cardholder was confirmed to be out of the country. What is the MOST likely explanation?

Accepted Answer

The credential was cloned and used by an unauthorized person

Answer

Credential cloning allows an attacker to duplicate a card and use it independently of the original cardholder, explaining a valid credential used when the legitimate holder was absent.

Question 5

A Wiegand interface between a card reader and access controller is found to have been tapped. What security vulnerability does this attack exploit?

Accepted Answer

Unencrypted plaintext credential data on the wire

Answer

The Wiegand protocol transmits card data in unencrypted plaintext, making it trivial to intercept and replay credential data if an attacker gains physical access to the wiring.

(CFL) Certified Forensic Locksmith Practice Test

(CFL) Certified Forensic Locksmith Practice Test

CFL Electronic Security Forensics 2