CFL Security System Analysis 2 — Questions and Answers
Question 1: When analyzing an alarm system for forensic evidence, which component is most likely to retain tamper data logs?
- Keypad membrane
- Control panel memory/event log (Correct answer)
- Door contact magnet
- Siren housing
Correct answer: Control panel memory/event log
The control panel event log stores timestamped records of zone activations, bypasses, and tamper events.
Question 2: A security camera system shows video gaps during an alleged burglary. Which forensic analysis should be performed FIRST?
- Replace the hard drive
- Examine DVR/NVR power and event logs for intentional disabling (Correct answer)
- Reformat the recording device
- Interview neighbors only
Correct answer: Examine DVR/NVR power and event logs for intentional disabling
Power cycling logs and DVR event records can reveal whether the system was manually disabled or lost power during the incident.
Question 3: In a layered security system, which layer is considered the 'detection' layer?
- Exterior fencing
- Interior motion sensors and glass break detectors (Correct answer)
- Deadbolt locks
- Security lighting
Correct answer: Interior motion sensors and glass break detectors
Interior sensors such as motion detectors and glass break detectors form the detection layer, alerting to intrusion after perimeter is breached.
Question 4: A forensic locksmith finds a door contact sensor displaced from its frame. What conclusion is MOST forensically sound?
- The door was never locked
- The sensor may have been deliberately moved to create a gap and bypass the zone (Correct answer)
- The installer made an error
- The sensor is irrelevant to the investigation
Correct answer: The sensor may have been deliberately moved to create a gap and bypass the zone
Displaced sensors can defeat zone monitoring; deliberate repositioning is a known bypass method and must be documented as potential evidence.
Question 5: What does a 'zone fault' condition indicate in a commercial intrusion detection system?
- All zones are secure
- A wiring issue or open circuit in a specific zone (Correct answer)
- The central station is offline
- A power surge occurred
Correct answer: A wiring issue or open circuit in a specific zone
A zone fault typically indicates a broken wire, disconnected sensor, or short circuit within that specific detection zone.
Question 6: Which access control credential type provides the strongest non-repudiation in a forensic investigation?
- Proximity card (125 kHz)
- PIN code entry
- Biometric fingerprint with audit log (Correct answer)
- Mechanical key
Correct answer: Biometric fingerprint with audit log
Biometric credentials with timestamped audit logs provide strong non-repudiation because they are tied to a unique physiological trait and cannot be shared like a PIN or card.
Question 7: When documenting a compromised access control system, what is the correct order of forensic steps?
- Repair, photograph, document, report
- Photograph, document, collect evidence, then repair (Correct answer)
- Report to police, then document
- Restore system first to prevent further loss
Correct answer: Photograph, document, collect evidence, then repair
Forensic protocol requires preserving the scene through photography and documentation before any evidence is collected or the system is altered.
CFL Security System Analysis 2
When analyzing an alarm system for forensic evidence, which component is most likely to retain tamper data logs?