CFL Security System Analysis 3 — Questions and Answers
Question 1: A commercial property uses an electromagnetic lock (magloc) on a door. During forensic analysis, what failure mode would indicate the lock was defeated electrically rather than mechanically?
- Scratches on the armature plate
- Cut or bypassed wiring at the power supply (Correct answer)
- Worn strike plate
- Bent door frame
Correct answer: Cut or bypassed wiring at the power supply
Maglocks require continuous power; cutting or bypassing the power supply will release the lock without leaving mechanical evidence on the door or hardware.
Question 2: In security system analysis, what is 'defense in depth'?
- Using a single high-quality lock
- Implementing multiple overlapping security layers so each layer compensates for weaknesses in others (Correct answer)
- Burying cables underground
- Installing cameras at maximum depth indoors
Correct answer: Implementing multiple overlapping security layers so each layer compensates for weaknesses in others
Defense in depth uses multiple security layers—physical, electronic, and procedural—so that defeating one layer does not compromise the entire system.
Question 3: A forensic examination reveals that a motion detector was covered with a bag during a burglary. What category of attack does this represent?
- Electronic spoofing
- Physical masking/defeating of a sensor (Correct answer)
- Signal jamming
- Credential cloning
Correct answer: Physical masking/defeating of a sensor
Physically obstructing a PIR or microwave motion sensor by covering it is classified as a physical masking attack on the detection layer.
Question 4: Which type of glass break detector is MOST susceptible to defeat by slowly cutting glass rather than breaking it?
- Dual-technology acoustic/flex sensor
- Acoustic-only glass break detector (Correct answer)
- Vibration sensor
- Microwave detector
Correct answer: Acoustic-only glass break detector
Acoustic-only glass break detectors listen for the high-frequency sound of shattering glass and will not trigger when glass is slowly cut with a glass cutter.
Question 5: What is the forensic significance of a 'walk test' mode being active on an alarm system at the time of a burglary?
- It means the system was armed and fully operational
- Walk test mode may disable central station reporting, preventing alarm transmission (Correct answer)
- Walk test mode triggers automatic police response
- It has no forensic relevance
Correct answer: Walk test mode may disable central station reporting, preventing alarm transmission
Walk test mode is used for sensor testing and typically suppresses central station notifications, which could be deliberately exploited to prevent alarm reporting.
Question 6: A biometric reader at an entry point shows 'anti-passback violation' in its log. What does this forensically indicate?
- The credential was cloned and used at two readers without an exit event between entries (Correct answer)
- The door was held open too long
- A power failure occurred
- The biometric template was corrupted
Correct answer: The credential was cloned and used at two readers without an exit event between entries
Anti-passback violations indicate a credential was used to enter twice without a recorded exit, suggesting tailgating, credential sharing, or cloning.
Question 7: When analyzing a CCTV system for forensic purposes, what is the primary importance of establishing the system's time synchronization status?
- To determine camera megapixel count
- To verify that timestamps accurately reflect real-world event times for evidentiary reliability (Correct answer)
- To calculate storage capacity
- To identify the camera manufacturer
Correct answer: To verify that timestamps accurately reflect real-world event times for evidentiary reliability
If the DVR/NVR clock is drifted or incorrect, recorded timestamps cannot be correlated with actual event times, undermining the evidentiary value of the footage.
CFL Security System Analysis 3
A commercial property uses an electromagnetic lock (magloc) on a door.
During forensic analysis, what failure mode would indicate the lock was defeated electrically rather than mechanically?