Certified Surveillance Technician (CST) — Questions and Answers

Question 1: An IP camera's video stream exhibits high latency and frame drops. Network testing shows 15% packet loss on the link. What is the first step to resolve this?

Disable H.265 and switch to MJPEG
Reduce the camera's resolution to 720p
Inspect and replace the Ethernet cable or connector (Correct answer)
Increase the camera's bitrate setting

Correct answer: Inspect and replace the Ethernet cable or connector

Packet loss at 15% strongly indicates a physical layer problem such as a damaged cable, bad crimp, or faulty connector that should be inspected first.

Question 2: Which power standard is commonly used to provide both data and power to networked access control readers and IP cameras?

RS-485
PoE (Power over Ethernet) (Correct answer)
12 VDC direct supply only
UPS battery backup

Correct answer: PoE (Power over Ethernet)

PoE delivers electrical power alongside data over a standard Ethernet cable, simplifying installation of network-connected access devices.

Question 3: Which storage technology is increasingly used in surveillance NVRs because it has no moving parts and faster read speeds?

Optical disc (Blu-ray)
Floppy disk
Solid-state drive (SSD) (Correct answer)
Magnetic tape

Correct answer: Solid-state drive (SSD)

SSDs offer faster read/write speeds, lower latency, and greater shock resistance compared to traditional HDDs for surveillance applications.

Question 4: During a fire alarm activation, most access control systems are programmed to:

Send an alert to the card reader display only
Require biometric authentication before doors will open
Lock all doors to prevent unauthorized evacuation routes
Unlock all controlled egress doors (fail-safe mode) to allow evacuation (Correct answer)

Correct answer: Unlock all controlled egress doors (fail-safe mode) to allow evacuation

Life-safety codes require access-controlled egress doors to fail-safe (unlock) upon fire alarm activation to allow unimpeded evacuation.

Question 5: In a dual-technology card reader, what is the purpose of combining two reader technologies?

To allow the reader to function without an access control panel
To reduce installation costs by sharing a single wire run
To require two different credential types for enhanced security (Correct answer)
To increase read range beyond 10 feet

Correct answer: To require two different credential types for enhanced security

Dual-technology readers require two credential types (e.g., proximity + smart card) to be presented simultaneously, significantly raising the bar for unauthorized access.

Question 6: When enrolling a finger for a fingerprint reader, best practice requires capturing how many sample scans?

2
3 to 5 (Correct answer)
10 or more
1

Correct answer: 3 to 5

Capturing 3 to 5 sample scans during enrollment creates a more robust biometric template and reduces false rejections.

Question 7: When installing a card reader on an exterior wall, which environmental rating should be verified to ensure outdoor survivability?

FCC Part 15
UL 294
IP65 or higher (Correct answer)
NEMA 1

Correct answer: IP65 or higher

An IP65 rating confirms the device is dust-tight and protected against water jets, suitable for outdoor or harsh environment installation.

Question 8: What is a hot spare drive in a RAID array used for surveillance?

A drive that records at a higher frame rate
A drive used only for software backups
An extra drive kept powered and ready to automatically replace a failed drive (Correct answer)
A spare drive stored in a warehouse for future expansion

Correct answer: An extra drive kept powered and ready to automatically replace a failed drive

A hot spare is an idle drive in the array that automatically begins rebuilding data when another drive fails, minimizing downtime.

Question 9: When installing an IP camera in an outdoor environment, which cable type is most appropriate for runs exposed to direct sunlight and temperature extremes?

Standard Cat5e UTP
Single-mode fiber with SC connectors
RG59 coaxial with BNC connectors
UV-rated outdoor Cat6 with direct-burial jacket (Correct answer)

Correct answer: UV-rated outdoor Cat6 with direct-burial jacket

UV-rated outdoor Cat6 with direct-burial jacket is designed to resist sunlight degradation, moisture, and temperature extremes common in outdoor installations.

Question 10: OSDP (Open Supervised Device Protocol) provides an advantage over Wiegand because it:

Supports bidirectional encrypted communication between reader and panel (Correct answer)
Operates at a lower voltage requiring less power
Is compatible with only HID credential formats
Requires fewer wires for installation

Correct answer: Supports bidirectional encrypted communication between reader and panel

OSDP supports bidirectional, encrypted communication, allowing the panel to receive status from and send commands to the reader — unlike the one-way Wiegand protocol.

Question 11: What is a 'write blocker' and when is it used in surveillance evidence handling?

A hardware/software device that prevents writing to source media during forensic imaging (Correct answer)
Software that prevents video editing on exported files
A DVR setting that locks recording to a specific camera
A legal injunction preventing evidence destruction

Correct answer: A hardware/software device that prevents writing to source media during forensic imaging

A write blocker is a forensic tool that allows reading from storage media while preventing any data from being written back, preserving original evidence.

Question 12: A surveillance system uses 'edge storage' on cameras with SD cards. What is the primary advantage of this approach?

Provides local video storage that continues recording even if the network connection fails (Correct answer)
Eliminates the need for video compression entirely
Reduces camera power consumption by eliminating network transmission
Increases camera resolution by offloading processing to the card

Correct answer: Provides local video storage that continues recording even if the network connection fails

Edge storage (SD card recording) in cameras provides a local backup that continues recording even when network connectivity to the NVR is lost, ensuring no footage gaps during network outages.

Question 13: When installing cameras in a facility that processes cardholder data, which compliance framework governs physical security requirements including surveillance system placement?

NIST SP 800-53 Moderate Baseline
HIPAA Security Rule (45 CFR Part 164)
PCI DSS (Payment Card Industry Data Security Standard) (Correct answer)
SOC 2 Type II Availability Criteria

Correct answer: PCI DSS (Payment Card Industry Data Security Standard)

PCI DSS includes physical security requirements, including monitoring of card data environments with surveillance cameras to protect cardholder data.

Question 14: A business requires 30 days of continuous surveillance footage. When calculating storage, which formula is MOST appropriate?

Camera count × lens focal length × 30
Bitrate (Mbps) × 3600 seconds × 24 hours × 30 days × camera count ÷ 8 (Correct answer)
Storage capacity ÷ camera count × 30
Resolution in pixels × frame rate × 30

Correct answer: Bitrate (Mbps) × 3600 seconds × 24 hours × 30 days × camera count ÷ 8

Multiplying bitrate by seconds per hour, hours per day, days retained, and camera count (then dividing by 8 to convert bits to bytes) gives total storage in megabytes.

Question 15: A building's surveillance system automatically overwrites oldest footage after 30 days. Law enforcement requests footage from 28 days ago. What is the technician's immediate priority?

Immediately export and preserve the footage before the overwrite cycle deletes it, then notify law enforcement (Correct answer)
Contact the DVR manufacturer for technical guidance
Disable all cameras to prevent any further overwriting
Wait for a formal subpoena before taking any action

Correct answer: Immediately export and preserve the footage before the overwrite cycle deletes it, then notify law enforcement

Immediate export is critical because overwrite cycles will destroy the evidence; preservation must occur before legal process formalities if evidence is at imminent risk.

Question 16: Under the UL 681 standard for installation of burglar and holdup alarm systems, what minimum wire gauge is typically required for detection circuit wiring?

22 AWG (Correct answer)
16 AWG
18 AWG
14 AWG

Correct answer: 22 AWG

UL 681 generally specifies a minimum of 22 AWG conductors for detection (zone) wiring in burglar alarm installations.

Question 17: What is the key disadvantage of RAID 0 for surveillance storage?

It requires a minimum of six drives
It cannot be used with NVRs
It is too slow for video recording
It provides no redundancy — a single drive failure causes total data loss (Correct answer)

Correct answer: It provides no redundancy — a single drive failure causes total data loss

RAID 0 stripes data across drives for performance but has zero fault tolerance — one drive failure loses all data.

Question 18: What is the key difference between a DVR and an NVR in surveillance systems?

DVRs support audio recording while NVRs do not
DVRs process analog camera signals while NVRs record from IP cameras over a network (Correct answer)
DVRs record in HD while NVRs record in SD
DVRs store footage on cloud servers while NVRs use local hard drives

Correct answer: DVRs process analog camera signals while NVRs record from IP cameras over a network

A DVR (Digital Video Recorder) processes and records analog camera signals, while an NVR (Network Video Recorder) receives and stores pre-encoded digital streams from IP cameras over a network.

Question 19: Which video analytic feature would best help a retail store understand customer traffic flow patterns?

Audio anomaly detection
License plate recognition
Perimeter intrusion detection
Heat mapping and people counting analytics (Correct answer)

Correct answer: Heat mapping and people counting analytics

Heat mapping and people counting analytics track movement patterns and visitor counts, providing insight into customer behavior and traffic flow within a retail environment.

Question 20: A balanced magnetic switch (BMS) is used instead of a standard door contact primarily to resist which attack method?

Magnetic field spoofing used to defeat standard reed switches (Correct answer)
High-temperature environments that demagnetize standard contacts
RF interference that mimics a closed-contact signal
Physical forcing of the door

Correct answer: Magnetic field spoofing used to defeat standard reed switches

A BMS uses a biased magnetic field that requires a specific magnetic signature to remain in the secure state, making it resistant to defeat by an external magnet placed near a standard reed switch.

Question 21: A central monitoring station receives a 'troubles' signal from an alarm panel. What does this signal typically indicate?

A duress alarm triggered by the user
A system fault condition such as low battery, AC power loss, or communication failure (Correct answer)
An active intrusion alarm
A successful arm/disarm event

Correct answer: A system fault condition such as low battery, AC power loss, or communication failure

Trouble signals indicate supervisory fault conditions within the system—such as low battery, loss of AC power, or a zone fault—rather than an active intrusion event.

Question 22: A facility experiences frequent 'door held open' alarms. The MOST likely cause is:

The card reader is losing power intermittently
The Wiegand cable run is too long
The biometric reader has corrupted templates
Users are propping the door open or not allowing it to fully latch (Correct answer)

Correct answer: Users are propping the door open or not allowing it to fully latch

'Door held open' alarms trigger when a door remains open beyond the configured time, most commonly due to users physically propping or impeding the door from closing.

Question 23: When a CST installs a license plate reader (LPR) system for a law enforcement client, which legal consideration is MOST important regarding data retention?

Many jurisdictions impose statutory limits on how long non-hit LPR records may be retained (Correct answer)
LPR data is classified as biometric data under all state laws
LPR data may be retained indefinitely with no restrictions
License plate information is not considered personal data under any U.S. law

Correct answer: Many jurisdictions impose statutory limits on how long non-hit LPR records may be retained

Numerous states have enacted laws limiting the retention period of LPR records for vehicles not associated with criminal activity, reflecting privacy concerns about mass location tracking.

Question 24: A seismic sensor installed on a safe would primarily detect which type of intrusion attempt?

Motion in the surrounding room
Glass breakage in the vicinity
Vibrations caused by drilling or cutting on the protected object (Correct answer)
Electromagnetic field changes near the safe

Correct answer: Vibrations caused by drilling or cutting on the protected object

Seismic sensors are tuned to detect low-frequency vibrations transmitted through solid objects, making them ideal for detecting physical attacks such as drilling or grinding on safes or vaults.

Question 25: What is 'audio analytics' in a surveillance system designed to detect?

Sound events such as gunshots, glass breaking, or aggressive speech (Correct answer)
Microphone hardware failures
Background noise levels for video quality
Audio codec compatibility

Correct answer: Sound events such as gunshots, glass breaking, or aggressive speech

Audio analytics processes sound in real time to detect specific events like gunshots, breaking glass, or screaming, triggering alerts even when visual analytics may not detect a threat.

Question 26: What is the primary advantage of using a cellular communicator as a backup path for an alarm system?

It reduces the central station monitoring fees
It allows wireless sensor installation
It provides communication even when telephone lines are cut or disabled (Correct answer)
It eliminates the need for a control panel

Correct answer: It provides communication even when telephone lines are cut or disabled

Cellular communicators operate independently of landline infrastructure, ensuring alarm signals reach the central station even if an intruder cuts the telephone lines.

Question 27: What is the benefit of using cloud storage as a backup for on-site surveillance recordings?

Cloud storage eliminates the need for on-site NVRs entirely
It allows cameras to operate without network connectivity
It provides off-site redundancy so footage survives on-site theft, fire, or hardware failure (Correct answer)
Cloud storage reduces camera installation costs

Correct answer: It provides off-site redundancy so footage survives on-site theft, fire, or hardware failure

Off-site cloud backup ensures footage is preserved even if the on-site NVR is stolen, destroyed, or suffers a hardware failure.

Question 28: Which storage media is generally preferred for long-term archival of exported surveillance video evidence?

Standard magnetic hard drives
Rewritable DVD-RW discs
USB flash drives (thumb drives)
Write-once optical media (DVD-R, BD-R) or WORM drives (Correct answer)

Correct answer: Write-once optical media (DVD-R, BD-R) or WORM drives

Write-once media physically prevents overwriting, providing tamper-evident storage that strengthens the case for unaltered evidence.

Question 29: An iris recognition system is classified as which type of biometric modality?

Token-based credential
Soft biometric
Behavioral biometric
Physiological biometric (Correct answer)

Correct answer: Physiological biometric

Iris recognition is a physiological biometric because it measures a stable, physical characteristic of the human body.

Question 30: What is the function of DHCP snooping on a switch where IP cameras are installed?

It prevents rogue DHCP servers from assigning unauthorized IP addresses (Correct answer)
It assigns static IPs to cameras based on MAC address
It encrypts DHCP requests from cameras on the network
It monitors camera bandwidth and throttles heavy streams

Correct answer: It prevents rogue DHCP servers from assigning unauthorized IP addresses

DHCP snooping validates DHCP messages and blocks offers from unauthorized DHCP servers, protecting cameras from receiving incorrect addressing.

Question 31: Which access card technology is considered the LEAST secure for high-security installations?

iCLASS SE
125 kHz proximity (HID Prox) (Correct answer)
MIFARE DESFire EV2
SEOS

Correct answer: 125 kHz proximity (HID Prox)

125 kHz proximity cards transmit data unencrypted and can be easily cloned using inexpensive off-the-shelf equipment.

Question 32: A surveillance system for a healthcare facility captures footage of patients receiving treatment. Which regulation MOST directly applies to handling and protecting this video data?

HIPAA Privacy Rule (Correct answer)
COPPA
FERPA
Gramm-Leach-Bliley Act

Correct answer: HIPAA Privacy Rule

HIPAA's Privacy Rule covers protected health information (PHI), and video footage showing identifiable patients receiving medical treatment can constitute PHI requiring HIPAA-compliant safeguards.

Question 33: Which technology allows surveillance systems to provide night vision?

Thermal imaging.
Laser detection.
Motion sensors.
Infrared (IR) technology. (Correct answer)

Correct answer: Infrared (IR) technology.

Infrared (IR) technology is commonly used in surveillance cameras to provide night vision capabilities. IR illuminators emit invisible infrared light, which the camera's sensor can detect, allowing it to capture clear images even in complete darkness for continuous monitoring.

Question 34: In a 'two-party consent' (all-party consent) state, recording a phone call legally requires:

A court order regardless of consent
Consent from the person initiating the call only
Consent from all parties to the conversation (Correct answer)
Written consent filed with the state attorney general

Correct answer: Consent from all parties to the conversation

All-party (two-party) consent states require every participant in a conversation to consent before the conversation may be legally recorded.

Question 35: A technician installs a photoelectric beam detector along a 500-foot fence line. At installation, what initial adjustment is most critical for reliable operation?

Setting the pulse frequency to match the receiver
Precisely aligning the transmitter beam with the center of the receiver lens (Correct answer)
Adjusting the detection range potentiometer to maximum
Programming the panel zone to a 24-hour response type

Correct answer: Precisely aligning the transmitter beam with the center of the receiver lens

Precise optical alignment of the transmitter beam with the receiver lens is critical; misalignment reduces signal margin, increasing susceptibility to false alarms and missed detections over long distances.

Question 36: What is the function of a 'privacy mask' in a surveillance camera system?

Reduce image resolution to comply with bandwidth limitations
Apply infrared filtering during daylight hours
Encrypt the video stream to prevent unauthorized viewing
Block specific areas of the camera's field of view from being recorded or displayed (Correct answer)

Correct answer: Block specific areas of the camera's field of view from being recorded or displayed

Privacy masks are configurable areas within a camera's field of view that are blocked out (blacked out or blurred) in both live view and recordings, protecting sensitive areas like restrooms or neighboring properties.

Question 37: Which VMS feature provides a chronological visual summary of all recorded activity periods for a camera, typically shown as a color-coded bar?

Sequence player
Activity heat map
Timeline scrubber (Correct answer)
Event log grid

Correct answer: Timeline scrubber

The timeline scrubber displays recording periods as a color-coded bar, allowing operators to visually identify recorded segments and quickly navigate to specific times.

Question 38: Which type of camera housing is required when installing surveillance cameras in a food processing facility?

NEMA 4X stainless steel housing (Correct answer)
IP66-rated metal housing
Indoor surface-mount box
Standard plastic dome

Correct answer: NEMA 4X stainless steel housing

NEMA 4X stainless steel housings resist corrosion and can withstand high-pressure washdowns common in food processing environments.

Question 39: Which doctrine holds that information voluntarily shared with a third party (e.g., a bank or phone company) loses Fourth Amendment protection?

Third-party doctrine (Correct answer)
Open fields doctrine
Curtilage doctrine
Plain view doctrine

Correct answer: Third-party doctrine

The third-party doctrine holds that individuals have no reasonable expectation of privacy in information voluntarily shared with third parties.

Question 40: During a maintenance inspection, a technician discovers that camera housings on a rooftop installation have faded and cracked UV seals. What is the primary risk?

Water ingress leading to equipment failure (Correct answer)
Reduced IR night vision range
Increased power consumption
Signal interference with adjacent cameras

Correct answer: Water ingress leading to equipment failure

Cracked seals allow moisture to enter the housing, which can damage the camera's electronics, lens, and sensor over time.

Question 41: A surveillance recorder's hard drive health check shows reallocated sector counts rising steadily. What action should be taken?

Reformat the drive in NTFS
Defragment the drive immediately
Lower the recording bitrate to reduce write cycles
Schedule a drive replacement before failure occurs (Correct answer)

Correct answer: Schedule a drive replacement before failure occurs

Rising reallocated sector counts indicate impending hard drive failure; proactive replacement prevents data loss and system downtime.

Question 42: Which concept describes the legally required documentation trail demonstrating that evidence (such as surveillance footage) has not been tampered with from collection through courtroom presentation?

Probable cause
Chain of custody (Correct answer)
Burden of proof
Discovery rule

Correct answer: Chain of custody

Chain of custody is the documented, chronological record of who handled evidence, when, and how, establishing its integrity and admissibility in legal proceedings.

Question 43: Which intrusion detection standard governs the grading of alarm systems for residential and commercial applications in the United States?

ANSI/SIA CP-01 (Correct answer)
UL 681
IEC 60839
UL 2050

Correct answer: ANSI/SIA CP-01

ANSI/SIA CP-01 is the Control Panel Standard that defines false alarm reduction features and grading criteria widely adopted by AHJs across the United States.

Question 44: An attorney requests only a 'clip' of the incident rather than the raw export. What should the technician do?

Provide the clip after re-encoding it in the attorney's preferred format
Provide only the requested clip, deleting the broader export to save storage
Preserve the full original export as primary evidence and provide a clearly labeled derivative clip as a copy (Correct answer)
Refuse the request as clips are never acceptable in legal proceedings

Correct answer: Preserve the full original export as primary evidence and provide a clearly labeled derivative clip as a copy

The original full export must be preserved as primary evidence while the clip is provided as a derivative copy with clear labeling to avoid confusion.

Question 45: A technician is tasked with installing a PTZ camera on a pole mount in a parking lot. What factor must be considered first before beginning the installation?

Ensuring the pole is painted a neutral color to reduce camera visibility
Verifying the pole has a pre-drilled hole for cable entry
Confirming the camera has built-in storage to operate independently
Calculating the pole's load-bearing capacity to support camera weight and wind load (Correct answer)

Correct answer: Calculating the pole's load-bearing capacity to support camera weight and wind load

Pole-mounted cameras, especially PTZs, exert significant wind load forces, so the pole must be rated to support the combined weight and dynamic wind forces to prevent failure.

Question 46: What is the purpose of configuring a 'pre-alarm buffer' in a VMS recording schedule?

To retain a short segment of video recorded before a triggering event so the full incident context is captured (Correct answer)
To delay recording start by a fixed interval after an event
To prevent recording from starting during network congestion
To skip redundant frames before compressing archived footage

Correct answer: To retain a short segment of video recorded before a triggering event so the full incident context is captured

A pre-alarm buffer continuously stores a short rolling window of video in memory so that when a trigger event occurs, the recording includes footage from before the alarm was activated.

Question 47: Under NFPA 731, who is qualified to perform the final acceptance test of an intrusion alarm system?

Only the local police department liaison
The building owner or their representative only
A qualified alarm technician, often verified by an industry certification such as ESA NTS or equivalent (Correct answer)
Any licensed electrician

Correct answer: A qualified alarm technician, often verified by an industry certification such as ESA NTS or equivalent

NFPA 731 requires acceptance testing to be performed by personnel qualified in alarm systems, typically demonstrated through certifications such as the ESA National Training School (NTS) or equivalent credentials.

Question 48: A CST professional encounters an unfamiliar situation while performing intrusion detection & monitoring duties. What is the most appropriate first action?

Consult relevant standards, guidelines, or a qualified supervisor before proceeding (Correct answer)
Apply a solution from an unrelated field without verification
Skip the task entirely and move to the next assignment
Proceed based on general assumptions to avoid delays

Correct answer: Consult relevant standards, guidelines, or a qualified supervisor before proceeding

When facing unfamiliar situations in intrusion detection & monitoring, the most appropriate action is to consult relevant standards, guidelines, or a qualified supervisor. This ensures safety, accuracy, and compliance while building professional knowledge.

Question 49: Which factor most significantly degrades the performance of a passive infrared (PIR) detector?

Low ambient light levels
Ambient noise above 85 dB
Ambient temperature approaching normal body temperature (Correct answer)
Detector mounted perpendicular to the expected direction of travel

Correct answer: Ambient temperature approaching normal body temperature

PIR detectors sense differential infrared radiation between a moving body and its background; when ambient temperature approaches body temperature (~98.6°F), the contrast diminishes and detection reliability drops.

Question 50: A customer reports that their outdoor microwave motion detector triggers frequently when no one is present. Which environmental factor is most likely responsible?

Low ambient temperature
High relative humidity
Direct sunlight on the detector housing
Vegetation movement caused by wind (Correct answer)

Correct answer: Vegetation movement caused by wind

Microwave sensors detect motion by measuring Doppler shift in reflected RF energy; moving vegetation such as tree branches or tall grass falls within their detection pattern and causes false alarms.

Question 51: An active infrared beam detector generates a fault condition when the receiver signal drops by what typical threshold percentage?

25% (Correct answer)
75%
50%
10%

Correct answer: 25%

Most active IR beam detectors are engineered to alarm when received signal strength drops by approximately 25%, balancing sensitivity with immunity to minor obstructions like fog or insects.

Question 52: When documenting activities related to card reader & biometric access, which practice is considered essential for CST certification holders?

Maintaining comprehensive records that include procedures, observations, results, and any anomalies (Correct answer)
Completing documentation only when requested by auditors or supervisors
Keeping documentation in personal notes that are not accessible to other team members
Recording only outcomes while omitting the methods and processes used

Correct answer: Maintaining comprehensive records that include procedures, observations, results, and any anomalies

Comprehensive documentation that includes procedures, observations, results, and any anomalies is essential in card reader & biometric access. This supports quality assurance, enables peer review, and satisfies regulatory and audit requirements.

Question 53: A PM task calls for checking the video wall display used in a control room. What is the primary maintenance concern for these displays?

Screen saver settings
HDMI cable color coding
USB port availability
Pixel uniformity degradation, backlight brightness, and heat dissipation (Correct answer)

Correct answer: Pixel uniformity degradation, backlight brightness, and heat dissipation

Video wall displays in continuous-use control rooms degrade in pixel uniformity and backlight brightness over time, and heat management must be verified to prevent premature failure.

Question 54: Which quality assurance method is most commonly applied in preventive maintenance schedules to verify that CST professional standards are being met?

Informal self-assessment without external validation
Relying on client satisfaction surveys as the sole measure of quality
Structured audits, peer reviews, and performance metrics aligned with industry benchmarks (Correct answer)
Annual reviews conducted exclusively by non-technical management

Correct answer: Structured audits, peer reviews, and performance metrics aligned with industry benchmarks

Structured audits, peer reviews, and performance metrics aligned with industry benchmarks are the most effective quality assurance methods in preventive maintenance schedules, providing objective, measurable evidence that CST standards are consistently met.

Question 55: A mantrap (or airlock) is used in physical security to:

Monitor card reader health via OSDP supervision
Store backup credentials offline
Control access by allowing only one person to pass between two interlocked doors at a time (Correct answer)
Prevent electromagnetic interference from entering server rooms

Correct answer: Control access by allowing only one person to pass between two interlocked doors at a time

A mantrap uses two interlocked doors so that the first must close and verify before the second opens, preventing tailgating and piggybacking.

Question 56: What is the primary purpose of a 'supervised' intrusion detection circuit?

To continuously verify circuit integrity and detect tampering or wiring faults (Correct answer)
To log all entry and exit events
To supervise guard patrol routes
To monitor operator login activity

Correct answer: To continuously verify circuit integrity and detect tampering or wiring faults

Supervised circuits use end-of-line resistors or active polling to detect open or short circuit conditions, indicating tampering, cut wires, or equipment failure.

Question 57: Which access control model assigns permissions based on a user's role within an organization rather than individual identity?

Attribute-Based Access Control (ABAC)
Mandatory Access Control (MAC)
Discretionary Access Control (DAC)
Role-Based Access Control (RBAC) (Correct answer)

Correct answer: Role-Based Access Control (RBAC)

RBAC grants access permissions based on defined organizational roles (e.g., 'employee,' 'manager,' 'security'), simplifying large-scale access management.

Question 58: In the context of intrusion detection & monitoring, what role does continuous professional development play for CST practitioners?

It is optional and only needed for career advancement
It ensures practitioners remain current with evolving standards, technologies, and best practices (Correct answer)
It serves primarily as a networking opportunity with no practical benefit
It is required only during the first year of certification

Correct answer: It ensures practitioners remain current with evolving standards, technologies, and best practices

Continuous professional development is essential in intrusion detection & monitoring because it ensures CST practitioners remain current with evolving standards, technologies, and best practices, maintaining competency throughout their careers.

Question 59: What is the maximum cable length specified by TIA-568 for a horizontal Cat5e/Cat6 run in a structured cabling system?

150 meters
100 meters
50 meters
90 meters (Correct answer)

Correct answer: 90 meters

TIA-568 specifies a maximum 90-meter horizontal cable run, with 10 meters reserved for patch cords, totaling a 100-meter channel.

Question 60: Which symptom most clearly indicates a failing video balun in a passive UTP camera installation?

PTZ control lag
Ghosting, noise, or complete loss of video at the receiver end (Correct answer)
Incorrect timestamp on recordings
Choppy frame rate on the NVR

Correct answer: Ghosting, noise, or complete loss of video at the receiver end

A failing passive video balun degrades the signal conversion between coax and UTP, causing ghosting, noise bars, or total video loss at the receiver.

Question 61: Which file format is commonly used for exporting surveillance footage to be played on standard media players or submitted as evidence?

CSV
RAW camera format
PSD
AVI or MP4 (Correct answer)

Correct answer: AVI or MP4

AVI and MP4 are widely supported video container formats that can be played on standard media players and accepted as evidence in legal proceedings.

Question 62: A VMS operator receives a 'storage full' warning. Which corrective action is most appropriate as an immediate response?

Restart all cameras to reduce bitrate
Check and adjust retention policies or add storage capacity (Correct answer)
Disable video analytics to reduce processing load
Delete active recorded footage to free space immediately

Correct answer: Check and adjust retention policies or add storage capacity

The immediate response should be to review retention policies to potentially shorten retention duration and to plan for additional storage capacity to prevent recording interruption.

Question 63: A surveillance system PM plan requires verification of access control integration with cameras. What is the most important item to test?

Monitor resolution settings
That a door access event triggers the correct camera to begin recording or pop up on the video wall (Correct answer)
Whether cameras can record audio
Cable management aesthetics

Correct answer: That a door access event triggers the correct camera to begin recording or pop up on the video wall

Access control integration relies on event-triggered camera actions; verifying that door events correctly activate associated cameras confirms the integration is functioning.

Question 64: Which recording mode is most appropriate for a high-security entrance where every event must be captured and storage is not a limiting concern?

Event-triggered recording with a 5-second pre-buffer only
Continuous 24/7 recording at full resolution and frame rate (Correct answer)
Scheduled recording during business hours only
Motion-only recording

Correct answer: Continuous 24/7 recording at full resolution and frame rate

Continuous 24/7 recording at full resolution and frame rate ensures no gaps in coverage at critical entry points, which is essential when complete accountability is required and storage is sufficient.

Question 65: A card reader is mounted at a height that is inaccessible to wheelchair users. This violates requirements under which U.S. regulation?

Americans with Disabilities Act (ADA) (Correct answer)
NFPA 72
UL 294
OSHA 1910

Correct answer: Americans with Disabilities Act (ADA)

The ADA specifies maximum reach ranges for operable controls, requiring card readers to be mounted within accessible reach for wheelchair users.

Question 66: An installer is verifying the 'walk test' of a PIR sensor. What movement pattern will produce the most reliable detection?

Walking directly toward the detector from the front
Standing still within the detection zone
Crawling below the lowest detection beam
Walking across the detector's field of view (lateral movement) (Correct answer)

Correct answer: Walking across the detector's field of view (lateral movement)

PIR detectors are most sensitive to lateral movement that crosses detection zones, maximizing the differential infrared signal as the body moves between segments of the Fresnel lens.

Question 67: What is a key challenge when using audio surveillance in public spaces?

Ensuring compliance with privacy laws and regulations. (Correct answer)
Audio surveillance is only effective indoors.
Audio surveillance can be used without any restrictions.
Audio surveillance is always more effective than video.

Correct answer: Ensuring compliance with privacy laws and regulations.

A key challenge when using audio surveillance in public spaces is ensuring compliance with privacy laws and regulations. Capturing audio can infringe on individuals' reasonable expectation of privacy, leading to strict legal restrictions and ethical considerations regarding consent and the scope of recording.

Question 68: A proximity card reader stops responding after a nearby lightning strike. The most likely damaged component is the:

Reader's surge protection or internal circuitry (Correct answer)
Card credential itself
Access control software database
Door strike mechanism

Correct answer: Reader's surge protection or internal circuitry

Lightning-induced surges most commonly damage the reader's electronics, particularly if surge protection devices are absent or insufficient.

Question 69: What is the function of an alarm control panel's 'event log' or 'history buffer'?

To record a time-stamped sequence of system events for review and audit (Correct answer)
To store encrypted user PINs
To queue alarm signals for transmission during communication failures
To log maintenance schedules

Correct answer: To record a time-stamped sequence of system events for review and audit

The event log maintains a time-stamped record of alarms, arm/disarm actions, faults, and user activity, which is critical for post-incident investigation and system auditing.

Question 70: When a private employer monitors employee computer usage on company equipment, which statement BEST reflects the legal standard in most U.S. states?

Employers must obtain a court order before monitoring any digital communications
Only IT personnel are legally permitted to review employee communications
Employees have no expectation of privacy on company equipment when properly notified (Correct answer)
Monitoring is only permitted with written consent from each employee

Correct answer: Employees have no expectation of privacy on company equipment when properly notified

Courts generally hold that employees have reduced or no expectation of privacy on employer-owned equipment when a clear policy and prior notice are provided.

Question 71: The California Consumer Privacy Act (CCPA) grants California residents rights regarding personal information collected by businesses. For a surveillance company, this MOST likely means:

All surveillance footage of California residents must be destroyed within 24 hours
Only footage shared with law enforcement is subject to CCPA requirements
Businesses must disclose what personal data (including surveillance footage) they collect and honor deletion requests under specified conditions (Correct answer)
Surveillance footage is explicitly exempted from CCPA as security data

Correct answer: Businesses must disclose what personal data (including surveillance footage) they collect and honor deletion requests under specified conditions

CCPA requires covered businesses to inform consumers of data collected (which can include surveillance footage) and to honor rights of access and deletion, subject to applicable exemptions.

Question 72: A surveillance technician is mounting a dome camera on a drop ceiling T-bar grid. Which mounting accessory is most appropriate?

Pendant mount with junction box
Surface mount box with conduit knockout
Parapet mount bracket with lag bolts
Flush mount ring designed for T-bar grid installation (Correct answer)

Correct answer: Flush mount ring designed for T-bar grid installation

A flush mount ring designed for T-bar grid installation allows the dome camera to sit level within the ceiling tile grid without requiring structural penetration.

Question 73: What is the purpose of the RTSP protocol in an IP camera system?

Encrypting video data between camera and NVR
Assigning IP addresses to cameras dynamically
Synchronizing camera clocks over the network
Streaming live video from cameras to clients (Correct answer)

Correct answer: Streaming live video from cameras to clients

RTSP (Real Time Streaming Protocol) is used to establish and control media sessions for live video streaming from IP cameras.

Question 74: What does 'circular recording' mean on a DVR or NVR?

Recording at variable frame rates
Recording only in a circular field of view
Recording in a loop where oldest footage is overwritten when storage is full (Correct answer)
A backup method that records to a remote server

Correct answer: Recording in a loop where oldest footage is overwritten when storage is full

Circular (loop) recording automatically overwrites the oldest footage when the storage drive reaches capacity, ensuring continuous recording.

Question 75: Which quality assurance method is most commonly applied in intrusion detection & monitoring to verify that CST professional standards are being met?

Informal self-assessment without external validation
Relying on client satisfaction surveys as the sole measure of quality
Structured audits, peer reviews, and performance metrics aligned with industry benchmarks (Correct answer)
Annual reviews conducted exclusively by non-technical management

Correct answer: Structured audits, peer reviews, and performance metrics aligned with industry benchmarks

Structured audits, peer reviews, and performance metrics aligned with industry benchmarks are the most effective quality assurance methods in intrusion detection & monitoring, providing objective, measurable evidence that CST standards are consistently met.

Question 76: A smart card stores biometric data directly on the card rather than in a central database. This approach is called:

Card-on-card enrollment
Match-on-card (MoC) (Correct answer)
Centralized biometric matching
Distributed template synchronization

Correct answer: Match-on-card (MoC)

Match-on-card (MoC) stores and processes the biometric template on the card itself, enhancing privacy since biometric data never leaves the credential.

Question 77: Which standard governs the testing and listing requirements for access control system units in the United States?

UL 294 (Correct answer)
UL 681
NFPA 72
ISO 27001

Correct answer: UL 294

UL 294 is the standard for Access Control System Units, covering performance, construction, and testing requirements for listed access control equipment.

Question 78: What is the primary ethical obligation of a CST professional when a conflict of interest arises during intrusion detection & monitoring activities?

Disclose the conflict to all relevant parties and recuse from the decision if necessary (Correct answer)
Ignore the conflict if it does not directly affect the current task
Proceed while favoring the outcome that benefits the professional personally
Resolve the conflict privately without informing stakeholders

Correct answer: Disclose the conflict to all relevant parties and recuse from the decision if necessary

The primary ethical obligation when a conflict of interest arises in intrusion detection & monitoring is to disclose it to all relevant parties and, if necessary, recuse from the decision. This maintains professional integrity and stakeholder trust.

Question 79: A security consultant recommends 'volumetric detection' for a high-value storage room. Which sensor type best fulfills this requirement?

Door contacts on all entry points
Microwave or PIR sensors covering the interior space (Correct answer)
Glass break detectors on all windows
Vibration sensors on the walls and ceiling

Correct answer: Microwave or PIR sensors covering the interior space

Volumetric detectors such as microwave or PIR sensors cover the three-dimensional interior space of a room, detecting any intruder who enters the volume regardless of how they gained access.

Question 80: Which type of motion sensor is best suited for detecting intruders in environments with large temperature fluctuations?

Microwave
Ultrasonic
Passive Infrared (PIR)
Dual-technology (PIR + microwave) (Correct answer)

Correct answer: Dual-technology (PIR + microwave)

Dual-technology sensors combine PIR and microwave detection, reducing false alarms caused by temperature changes that would trigger a PIR-only sensor.

Question 81: Which quality assurance method is most commonly applied in card reader & biometric access to verify that CST professional standards are being met?

Structured audits, peer reviews, and performance metrics aligned with industry benchmarks (Correct answer)
Relying on client satisfaction surveys as the sole measure of quality
Annual reviews conducted exclusively by non-technical management
Informal self-assessment without external validation

Correct answer: Structured audits, peer reviews, and performance metrics aligned with industry benchmarks

Structured audits, peer reviews, and performance metrics aligned with industry benchmarks are the most effective quality assurance methods in card reader & biometric access, providing objective, measurable evidence that CST standards are consistently met.

Question 82: What does the term 'credential management' refer to in access control?

Physically installing card readers at entry points
Programming the door strike release time
The lifecycle process of issuing, tracking, modifying, and revoking access credentials (Correct answer)
Calibrating biometric reader sensitivity

Correct answer: The lifecycle process of issuing, tracking, modifying, and revoking access credentials

Credential management encompasses the entire lifecycle of access credentials — from issuance and assignment to modification and revocation.

Question 83: What is the primary ethical obligation of a CST professional when a conflict of interest arises during cctv camera selection & placement activities?

Ignore the conflict if it does not directly affect the current task
Disclose the conflict to all relevant parties and recuse from the decision if necessary (Correct answer)
Proceed while favoring the outcome that benefits the professional personally
Resolve the conflict privately without informing stakeholders

Correct answer: Disclose the conflict to all relevant parties and recuse from the decision if necessary

The primary ethical obligation when a conflict of interest arises in cctv camera selection & placement is to disclose it to all relevant parties and, if necessary, recuse from the decision. This maintains professional integrity and stakeholder trust.

Question 84: Which zone type on an intrusion alarm panel will trigger an immediate alarm regardless of the armed state of the system?

Entry/exit zone
24-hour zone (Correct answer)
Interior follower zone
Perimeter zone

Correct answer: 24-hour zone

A 24-hour zone remains active and will generate an alarm at all times—whether the system is armed or disarmed—typically used for panic buttons, smoke detectors, or tamper circuits.

Question 85: Which factor has the GREATEST impact on the storage capacity required for a surveillance system?

The length of the camera cable
The color of the camera housing
The type of camera mount
The resolution, frame rate, and compression codec used (Correct answer)

Correct answer: The resolution, frame rate, and compression codec used

Higher resolution, higher frame rates, and less efficient codecs all increase the storage space consumed per hour of recorded video.

Question 86: Which communication protocol is most commonly used between a card reader and an access control panel?

Wiegand (Correct answer)
Ethernet TCP/IP
RS-232
RS-485

Correct answer: Wiegand

Wiegand is the industry-standard protocol for transmitting card data from a reader to an access control panel.

Question 87: What is the purpose of a 'health monitor' module in a VMS?

To track operator login frequency
To manage user password expiration
To monitor system components like cameras, servers, and storage for faults (Correct answer)
To regulate video compression quality

Correct answer: To monitor system components like cameras, servers, and storage for faults

The health monitor module continuously checks the status of cameras, recording servers, and storage devices, alerting administrators to faults or offline components.

Question 88: What is 'tailgating' in the context of access control?

A software glitch that grants access after hours
An unauthorized person following an authorized person through a secured door (Correct answer)
A reader malfunction caused by excessive card swipes
A biometric enrollment error that allows multiple users the same template

Correct answer: An unauthorized person following an authorized person through a secured door

Tailgating occurs when an unauthorized individual closely follows an authorized user through a secured entry point before the door closes.

Question 89: What is the purpose of synchronizing IP cameras to an NTP (Network Time Protocol) server?

Coordinate PTZ camera movements across multiple units
Ensure accurate, consistent timestamps across all cameras for forensic integrity (Correct answer)
Automatically adjust camera sensitivity based on time of day
Increase video frame rates during peak recording times

Correct answer: Ensure accurate, consistent timestamps across all cameras for forensic integrity

NTP synchronization ensures all cameras and recorders share accurate, consistent time stamps, which is critical for correlating events across multiple cameras and maintaining forensic integrity of recordings.

Question 90: RAID 5 requires a minimum of how many drives?

6
2
3 (Correct answer)
4

Correct answer: 3

RAID 5 requires at least 3 drives to distribute parity data across all drives while maintaining read/write performance.

Question 91: What is the purpose of motion-triggered recording in a surveillance storage strategy?

To improve camera image quality during motion events
To enable pan-tilt-zoom on fixed cameras
To reduce storage usage by only recording when activity is detected (Correct answer)
To automatically alert police when motion is detected

Correct answer: To reduce storage usage by only recording when activity is detected

Motion-triggered recording conserves storage by only writing video to disk when motion is detected rather than recording continuously.

Question 92: What is the primary advantage of an NVR over a DVR for modern surveillance installations?

NVRs process video data from IP cameras directly over the network (Correct answer)
NVRs do not require hard drives
NVRs only support analog cameras
NVRs are less expensive than DVRs

Correct answer: NVRs process video data from IP cameras directly over the network

An NVR receives already-encoded digital video streams from IP cameras over the network, eliminating the need for analog encoding hardware.

Question 93: When an alarm panel is in 'test mode,' what is the expected behavior of alarm signals sent to the central station?

Signals are transmitted but flagged so the central station knows not to dispatch (Correct answer)
Signals are transmitted normally and treated as real alarms
Signals are suppressed entirely and not transmitted
Signals are re-routed to the local fire panel

Correct answer: Signals are transmitted but flagged so the central station knows not to dispatch

During test mode, the panel transmits signals to the central station but includes a test identifier, so operators acknowledge receipt without dispatching emergency responders.

Question 94: In the context of card reader & biometric access, what role does continuous professional development play for CST practitioners?

It ensures practitioners remain current with evolving standards, technologies, and best practices (Correct answer)
It is required only during the first year of certification
It is optional and only needed for career advancement
It serves primarily as a networking opportunity with no practical benefit

Correct answer: It ensures practitioners remain current with evolving standards, technologies, and best practices

Continuous professional development is essential in card reader & biometric access because it ensures CST practitioners remain current with evolving standards, technologies, and best practices, maintaining competency throughout their careers.

Question 95: In intrusion detection systems, what does the term 'cross-zoning' refer to?

Requiring two separate zones to alarm before triggering a response (Correct answer)
Dividing a facility into geographic sectors
Connecting zones from different buildings
Wiring sensors across multiple panels

Correct answer: Requiring two separate zones to alarm before triggering a response

Cross-zoning requires activation of two independent detection zones to confirm an intrusion before generating an alarm, significantly reducing false alarm rates.

Question 96: What distinguishes a 'holdup' alarm from a standard 'burglary' alarm in a commercial intrusion detection system?

Holdup alarms are always silent; burglary alarms always sound audibly
Holdup alarms use wireless sensors; burglary alarms use wired sensors
Holdup alarms are triggered covertly by occupants under duress; burglary alarms detect unauthorized entry (Correct answer)
Holdup alarms require police response; burglary alarms notify a guard service

Correct answer: Holdup alarms are triggered covertly by occupants under duress; burglary alarms detect unauthorized entry

Holdup (panic) alarms are activated covertly by employees when threatened by robbery, while burglary alarms respond automatically to unauthorized intrusion attempts.

Question 97: What should a technician check when performing preventive maintenance on a PoE switch that powers IP cameras?

Wi-Fi signal strength
USB drive capacity
HDMI port availability
Per-port power draw vs. rated PoE budget (Correct answer)

Correct answer: Per-port power draw vs. rated PoE budget

Verifying per-port power consumption against the switch's PoE budget ensures no cameras are being under-powered or causing switch overload.

Question 98: A casino surveillance manager wants to identify card values on a gaming table from a camera mounted 12 feet above. Which specification is most critical?

PTZ capability for operator control
Wide field of view to see the entire table
High pixel density (pixels per foot) at the table surface (Correct answer)
Low-light sensitivity below 0.1 lux

Correct answer: High pixel density (pixels per foot) at the table surface

Resolving small card markings requires sufficient pixels per foot at the table surface, making pixel density the primary specification for this application.

Question 99: Which factor most directly affects the performance of AI-based video analytics in low-light conditions?

The number of recording channels on the NVR
The video compression codec being used
The IP addressing scheme of the surveillance network
Camera image quality and sensitivity in low-light environments (Correct answer)

Correct answer: Camera image quality and sensitivity in low-light environments

AI video analytics relies on clear, high-quality images; cameras with poor low-light performance produce noisy images that significantly degrade object detection and classification accuracy.

Question 100: A surveillance technician installs a camera that captures the interior of a private home through an open window from a public sidewalk. Under Fourth Amendment analysis, this is:

Permissible because the view is from a public vantage point
Only permissible if law enforcement requested it
Permissible because no physical trespass occurred
A violation because the home's interior is protected space (Correct answer)

Correct answer: A violation because the home's interior is protected space

Even from a public vantage point, capturing the interior of a home where occupants have a reasonable expectation of privacy can constitute a Fourth Amendment violation.

Certified Surveillance Technician (CST)

The CST certification validates proficiency in designing, installing, and maintaining electronic surveillance systems including CCTV cameras, access control, intrusion detection, network security, and digital storage solutions. It covers the full scope of skills required for professional surveillance technicians across physical security and IP-based systems.

100

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds