CFL Electronic Security Forensics 3

Question 1

A forensic examination of an IP-based access control door controller reveals its default administrator credentials were never changed. What class of vulnerability does this represent?

Accepted Answer

Default credential vulnerability

Answer

Unchanged default credentials are a well-known configuration vulnerability that allows any attacker with knowledge of the device model to gain administrative access.

Question 2

During investigation of a commercial burglary, the forensic locksmith determines the electric strike was released without a credential. Which method should be examined FIRST?

Accepted Answer

Loiding the strike with a credit card or shim

Answer

Electric strikes with inadequate dead-latch or latchbolt engagement can often be loided (shimmed) with a flexible tool, bypassing the electronic control entirely — the simplest and most common mechanical bypass.

Question 3

What is the forensic significance of a 'Request to Exit' (REX) sensor activation recorded in an access control audit log during a suspected intrusion?

Accepted Answer

It indicates the door was opened from the inside, suggesting an accomplice or prior unauthorized access

Answer

REX sensors release the door latch from the secure side, so a REX event without a corresponding entry credential suggests someone was already inside or the sensor was manipulated.

Question 4

An OSDP (Open Supervised Device Protocol) reader is found to have been replaced with a counterfeit unit. What is the PRIMARY security advantage OSDP has over Wiegand that this attack was likely designed to circumvent?

Accepted Answer

Bidirectional encrypted communication between reader and controller

Answer

OSDP v2 provides AES-128 encrypted, bidirectional communication, making wire tapping attacks ineffective — attackers therefore substituted the reader itself rather than tapping the wires.

Question 5

When documenting an electronic lock for a forensic report, which data should be recorded from the lock's firmware?

Accepted Answer

Version number, manufacturer, and last update date

Answer

Firmware version, manufacturer, and update history establish the security patch level and can identify known vulnerabilities or whether unauthorized firmware modifications were made.

(CFL) Certified Forensic Locksmith Practice Test

(CFL) Certified Forensic Locksmith Practice Test

CFL Electronic Security Forensics 3