Certified Surveillance Technician (CST) — Questions and Answers

Question 1: What is the role of an NTP server in an IP camera network?

To synchronize the clocks of all cameras to a common time reference (Correct answer)
To store camera configuration backups on the network
To manage RTSP session authentication for video streams
To assign IP addresses to cameras automatically

Correct answer: To synchronize the clocks of all cameras to a common time reference

NTP (Network Time Protocol) synchronizes camera clocks to an accurate time source, ensuring timestamps on recorded footage are consistent and legally reliable.

Question 2: Which quality assurance method is most commonly applied in card reader & biometric access to verify that CST professional standards are being met?

Relying on client satisfaction surveys as the sole measure of quality
Annual reviews conducted exclusively by non-technical management
Informal self-assessment without external validation
Structured audits, peer reviews, and performance metrics aligned with industry benchmarks (Correct answer)

Correct answer: Structured audits, peer reviews, and performance metrics aligned with industry benchmarks

Structured audits, peer reviews, and performance metrics aligned with industry benchmarks are the most effective quality assurance methods in card reader & biometric access, providing objective, measurable evidence that CST standards are consistently met.

Question 3: Which factor most significantly degrades the performance of a passive infrared (PIR) detector?

Ambient temperature approaching normal body temperature (Correct answer)
Low ambient light levels
Detector mounted perpendicular to the expected direction of travel
Ambient noise above 85 dB

Correct answer: Ambient temperature approaching normal body temperature

PIR detectors sense differential infrared radiation between a moving body and its background; when ambient temperature approaches body temperature (~98.6°F), the contrast diminishes and detection reliability drops.

Question 4: When documenting activities related to intrusion detection & monitoring, which practice is considered essential for CST certification holders?

Maintaining comprehensive records that include procedures, observations, results, and any anomalies (Correct answer)
Completing documentation only when requested by auditors or supervisors
Keeping documentation in personal notes that are not accessible to other team members
Recording only outcomes while omitting the methods and processes used

Correct answer: Maintaining comprehensive records that include procedures, observations, results, and any anomalies

Comprehensive documentation that includes procedures, observations, results, and any anomalies is essential in intrusion detection & monitoring. This supports quality assurance, enables peer review, and satisfies regulatory and audit requirements.

Question 5: A technician notices that a contactless card reader grants access even when a card is presented inside a wallet at a distance of 6 inches. This indicates the reader likely uses:

A short-range NFC reader limited to 1–2 cm
An extended-range 125 kHz or 13.56 MHz reader with high RF output (Correct answer)
A Wiegand bus operating at maximum voltage
A PIN pad that auto-enters a default code

Correct answer: An extended-range 125 kHz or 13.56 MHz reader with high RF output

Extended-range readers are tuned to activate credentials at greater distances, which can be a security concern because cards in pockets or wallets may be read unintentionally.

Question 6: Under GDPR (applicable when a U.S. firm handles data of EU residents), video surveillance footage that captures identifiable individuals is classified as:

Criminal justice data exempt from standard GDPR rules
Biometric data requiring explicit consent in all circumstances
Personal data subject to GDPR's processing requirements and data subject rights (Correct answer)
Publicly available data exempt from all regulation

Correct answer: Personal data subject to GDPR's processing requirements and data subject rights

GDPR classifies footage of identifiable individuals as personal data, requiring a lawful basis for processing, appropriate retention limits, and observance of data subject rights such as access and erasure.

Question 7: What is the purpose of re-torquing conduit fittings during a surveillance system maintenance inspection?

To ensure weathertight seals and prevent moisture ingress (Correct answer)
To comply with IP67 ratings for cameras
To reduce signal attenuation
To increase cable bandwidth

Correct answer: To ensure weathertight seals and prevent moisture ingress

Conduit fittings can loosen over time due to thermal expansion and vibration; re-torquing ensures weathertight seals that keep moisture and pests out of cable runs.

Question 8: A smart card stores biometric data directly on the card rather than in a central database. This approach is called:

Card-on-card enrollment
Centralized biometric matching
Distributed template synchronization
Match-on-card (MoC) (Correct answer)

Correct answer: Match-on-card (MoC)

Match-on-card (MoC) stores and processes the biometric template on the card itself, enhancing privacy since biometric data never leaves the credential.

Question 9: What does WDR (Wide Dynamic Range) accomplish in an IP camera?

Compresses video files to reduce storage usage
Extends the camera's wireless transmission range
Balances exposure to capture detail in both bright and dark areas simultaneously (Correct answer)
Increases the number of frames per second during motion events

Correct answer: Balances exposure to capture detail in both bright and dark areas simultaneously

WDR technology combines multiple exposures to produce a single image with visible detail in both bright and shadowed areas of the same frame.

Question 10: A PM schedule includes testing video analytics such as motion detection. What is the best method to verify motion detection is working correctly?

Inspect the camera housing for cracks
Check the camera's power consumption
Walk through the detection zone and confirm an alert is triggered (Correct answer)
Review last month's recorded footage

Correct answer: Walk through the detection zone and confirm an alert is triggered

Physically walking through the detection zone while monitoring the system confirms that motion detection triggers correctly in real-world conditions.

Question 11: A surveillance technician exports footage using proprietary DVR software that requires a viewer application to play back. What is the key concern for legal proceedings?

The export will lack audio channels
The file will be too large for court exhibits
The court may not have or accept the proprietary player, limiting accessibility (Correct answer)
Proprietary formats always compress evidence and cause data loss

Correct answer: The court may not have or accept the proprietary player, limiting accessibility

Proprietary formats require specific software to view, which may not be available to opposing counsel or the court, potentially challenging admissibility.

Question 12: In Carpenter v. United States (2018), the Supreme Court ruled that accessing historical cell-site location information (CSLI) requires:

Consent from the cellular carrier only
A warrant supported by probable cause (Correct answer)
A subpoena certified as relevant to an investigation
Notification to the target within 90 days

Correct answer: A warrant supported by probable cause

Carpenter held that the third-party doctrine does not apply to historical CSLI because it reveals a detailed chronicle of a person's movements and requires a warrant.

Question 13: When a biometric access system is used at a border crossing or high-security facility, which performance metric is typically prioritized over the other?

Low False Rejection Rate (FRR) to speed throughput
High template size to maximize accuracy
High enrollment speed to reduce queues
Low False Acceptance Rate (FAR) to prevent unauthorized entry (Correct answer)

Correct answer: Low False Acceptance Rate (FAR) to prevent unauthorized entry

In high-security environments, minimizing unauthorized access (low FAR) takes precedence over user convenience, even if legitimate users are occasionally rejected.

Question 14: In a dual-technology card reader, what is the purpose of combining two reader technologies?

To increase read range beyond 10 feet
To require two different credential types for enhanced security (Correct answer)
To allow the reader to function without an access control panel
To reduce installation costs by sharing a single wire run

Correct answer: To require two different credential types for enhanced security

Dual-technology readers require two credential types (e.g., proximity + smart card) to be presented simultaneously, significantly raising the bar for unauthorized access.

Question 15: A technician is installing a multi-camera system with analog HD cameras (HD-TVI) and is selecting a DVR. What specification must match between the cameras and DVR?

The cameras and DVR must share the same ONVIF profile level
All cameras must use the same focal length lens for the DVR to process video uniformly
The cameras must be configured for the same RTSP stream path format as the DVR
The HD-TVI format version and resolution must be compatible between cameras and DVR (Correct answer)

Correct answer: The HD-TVI format version and resolution must be compatible between cameras and DVR

HD-TVI is a proprietary analog HD format with multiple versions (1.0, 2.0, 3.0) and resolutions; the DVR must explicitly support the same TVI version and resolution as the cameras.

Question 16: Which term describes surveillance conducted by the government specifically targeting an individual based on their First Amendment activities (such as political speech or religious practice) without legitimate law enforcement purpose?

Consensual monitoring
Chilling effect surveillance (Correct answer)
Lawful intercept
Pretextual stop

Correct answer: Chilling effect surveillance

Chilling effect surveillance describes government monitoring that deters individuals from exercising constitutional rights such as free speech or religion, and is generally considered an unconstitutional abuse of surveillance authority.

Question 17: Which quality assurance method is most commonly applied in ip camera & poe networking to verify that CST professional standards are being met?

Informal self-assessment without external validation
Relying on client satisfaction surveys as the sole measure of quality
Annual reviews conducted exclusively by non-technical management
Structured audits, peer reviews, and performance metrics aligned with industry benchmarks (Correct answer)

Correct answer: Structured audits, peer reviews, and performance metrics aligned with industry benchmarks

Structured audits, peer reviews, and performance metrics aligned with industry benchmarks are the most effective quality assurance methods in ip camera & poe networking, providing objective, measurable evidence that CST standards are consistently met.

Question 18: OSDP (Open Supervised Device Protocol) provides an advantage over Wiegand because it:

Is compatible with only HID credential formats
Supports bidirectional encrypted communication between reader and panel (Correct answer)
Requires fewer wires for installation
Operates at a lower voltage requiring less power

Correct answer: Supports bidirectional encrypted communication between reader and panel

OSDP supports bidirectional, encrypted communication, allowing the panel to receive status from and send commands to the reader — unlike the one-way Wiegand protocol.

Question 19: An iris recognition system is classified as which type of biometric modality?

Physiological biometric (Correct answer)
Token-based credential
Soft biometric
Behavioral biometric

Correct answer: Physiological biometric

Iris recognition is a physiological biometric because it measures a stable, physical characteristic of the human body.

Question 20: Which H.264 profile is most commonly used in IP cameras to balance compression efficiency and hardware compatibility?

Main Profile
Extended Profile
High Profile (Correct answer)
Baseline Profile

Correct answer: High Profile

High Profile provides the best compression efficiency and is widely supported by modern IP cameras and NVRs for surveillance applications.

Question 21: How often should a surveillance system undergo preventive maintenance?

Every 3-6 months. (Correct answer)
Every month.
Annually.
Every 2 years.

Correct answer: Every 3-6 months.

A surveillance system should ideally undergo preventive maintenance every 3-6 months. This regular schedule ensures that components are cleaned, connections are secure, software is updated, and minor issues are identified and addressed proactively, ensuring the system's continuous optimal performance and longevity.

Question 22: A security consultant recommends 'volumetric detection' for a high-value storage room. Which sensor type best fulfills this requirement?

Microwave or PIR sensors covering the interior space (Correct answer)
Glass break detectors on all windows
Vibration sensors on the walls and ceiling
Door contacts on all entry points

Correct answer: Microwave or PIR sensors covering the interior space

Volumetric detectors such as microwave or PIR sensors cover the three-dimensional interior space of a room, detecting any intruder who enters the volume regardless of how they gained access.

Question 23: In intrusion detection systems, what does the term 'cross-zoning' refer to?

Requiring two separate zones to alarm before triggering a response (Correct answer)
Wiring sensors across multiple panels
Connecting zones from different buildings
Dividing a facility into geographic sectors

Correct answer: Requiring two separate zones to alarm before triggering a response

Cross-zoning requires activation of two independent detection zones to confirm an intrusion before generating an alarm, significantly reducing false alarm rates.

Question 24: Which factor has the GREATEST impact on the storage capacity required for a surveillance system?

The color of the camera housing
The type of camera mount
The resolution, frame rate, and compression codec used (Correct answer)
The length of the camera cable

Correct answer: The resolution, frame rate, and compression codec used

Higher resolution, higher frame rates, and less efficient codecs all increase the storage space consumed per hour of recorded video.

Question 25: In the context of card reader & biometric access, what role does continuous professional development play for CST practitioners?

It is optional and only needed for career advancement
It serves primarily as a networking opportunity with no practical benefit
It ensures practitioners remain current with evolving standards, technologies, and best practices (Correct answer)
It is required only during the first year of certification

Correct answer: It ensures practitioners remain current with evolving standards, technologies, and best practices

Continuous professional development is essential in card reader & biometric access because it ensures CST practitioners remain current with evolving standards, technologies, and best practices, maintaining competency throughout their careers.

Question 26: What is 'tailgating' in the context of access control?

A software glitch that grants access after hours
An unauthorized person following an authorized person through a secured door (Correct answer)
A reader malfunction caused by excessive card swipes
A biometric enrollment error that allows multiple users the same template

Correct answer: An unauthorized person following an authorized person through a secured door

Tailgating occurs when an unauthorized individual closely follows an authorized user through a secured entry point before the door closes.

Question 27: In perimeter intrusion detection, a buried geophone cable detects which type of threat?

Ground vibrations caused by footsteps or vehicle movement (Correct answer)
Electromagnetic interference from nearby equipment
Changes in soil moisture indicating tunnel digging
RF signals from unauthorized communication devices

Correct answer: Ground vibrations caused by footsteps or vehicle movement

Geophone (seismic) cables buried along a perimeter detect low-frequency ground vibrations generated by walking, running, or vehicle traffic, enabling early perimeter breach detection.

Question 28: When enrolling a finger for a fingerprint reader, best practice requires capturing how many sample scans?

1
3 to 5 (Correct answer)
10 or more
2

Correct answer: 3 to 5

Capturing 3 to 5 sample scans during enrollment creates a more robust biometric template and reduces false rejections.

Question 29: A surveillance technician discovers that footage requested by a client contains evidence of an unrelated crime. What is the MOST ethical course of action?

Retain the footage indefinitely without informing anyone
Consult legal counsel and, if required by law, cooperate with law enforcement (Correct answer)
Delete the footage to protect client confidentiality
Provide the footage only to the client and let them decide

Correct answer: Consult legal counsel and, if required by law, cooperate with law enforcement

Ethical practice and potential legal obligations (such as mandatory reporting or response to subpoenas) require consulting counsel and cooperating with law enforcement when evidence of a crime is discovered.

Question 30: Which audio surveillance technology is used to enhance audio clarity in noisy environments?

Directional microphones and noise-canceling technology. (Correct answer)
Amplifiers.
Omni-directional microphones.
Regular microphones.

Correct answer: Directional microphones and noise-canceling technology.

Directional microphones are designed to pick up sound primarily from a specific direction, reducing unwanted background noise. When combined with noise-canceling technology, which actively filters out ambient sounds, audio clarity is significantly enhanced, making conversations and specific sounds more discernible in noisy environments.

Question 31: Which tool is commonly used for testing the power supply of surveillance cameras?

Multimeter. (Correct answer)
Soldering iron.
Oscilloscope.
Power tester.

Correct answer: Multimeter.

A multimeter is a versatile electronic measuring instrument commonly used for testing the power supply of surveillance cameras. It allows technicians to accurately measure voltage, current, and resistance, ensuring that the camera is receiving the correct power specifications required for its operation.

Question 32: What is the primary purpose of a camera's IR cut filter (ICR)?

To increase frame rate in low-light conditions
To physically switch between day and night modes for accurate color rendering (Correct answer)
To reduce lens flare from artificial lighting
To block visible light during daytime to improve color accuracy

Correct answer: To physically switch between day and night modes for accurate color rendering

The ICR mechanically moves a filter in front of the sensor, blocking infrared in daylight for true color and removing it at night for better low-light sensitivity.

Question 33: When retaining surveillance footage, a best practice from an ethical and legal standpoint is to:

Keep all footage indefinitely for potential future use
Follow a documented retention policy aligned with legal requirements and delete footage when retention periods expire (Correct answer)
Store footage only on local drives not connected to any network
Transfer all footage ownership to the client immediately upon capture

Correct answer: Follow a documented retention policy aligned with legal requirements and delete footage when retention periods expire

A documented retention policy that complies with applicable laws and regulations ensures footage is kept as long as legally required and securely destroyed afterward, minimizing privacy risks.

Question 34: In a monitored alarm system, what is the standard communication path used as a primary channel under UL 2050 requirements?

Radio frequency (RF) transmission
Cellular-only transmission
Internet (IP) transmission
Digital communicator over PSTN (Correct answer)

Correct answer: Digital communicator over PSTN

UL 2050 traditionally recognizes the digital communicator over the Public Switched Telephone Network (PSTN) as the primary communication path, though IP and cellular are now widely used as supplements or replacements.

Question 35: A PM schedule calls for verifying UPS battery backup for surveillance equipment. What is the most important test parameter to check?

Number of outlets used
Ambient temperature of the server room only
Battery runtime under load (Correct answer)
UPS enclosure color

Correct answer: Battery runtime under load

Battery runtime under load confirms the UPS can sustain surveillance equipment for the required duration during a power outage.

Question 36: What is the legal responsibility of the surveillance system installer regarding data storage?

Make the footage available to all employees.
Ensure footage is stored on local hard drives.
Store footage for a period of one year.
Ensure footage is stored securely and complies with data protection laws. (Correct answer)

Correct answer: Ensure footage is stored securely and complies with data protection laws.

The legal responsibility of a surveillance system installer regarding data storage is to ensure footage is stored securely and complies with data protection laws. This includes implementing measures to prevent unauthorized access, loss, or alteration of sensitive data, and adhering to regulations concerning retention periods and data access.

Question 37: What is the function of an alarm control panel's 'event log' or 'history buffer'?

To queue alarm signals for transmission during communication failures
To record a time-stamped sequence of system events for review and audit (Correct answer)
To store encrypted user PINs
To log maintenance schedules

Correct answer: To record a time-stamped sequence of system events for review and audit

The event log maintains a time-stamped record of alarms, arm/disarm actions, faults, and user activity, which is critical for post-incident investigation and system auditing.

Question 38: When integrating an intrusion detection system with access control, which event pairing provides the strongest verification of unauthorized entry?

Invalid PIN attempt AND valid access granted
Motion detection alarm AND door held-open alarm
Door forced open alarm AND motion detected in the secured area (Correct answer)
Door forced open alarm AND valid access credential used

Correct answer: Door forced open alarm AND motion detected in the secured area

Correlating a door forced-open event with motion detected inside the secured zone provides strong confirmation of unauthorized physical entry without a valid credential.

Question 39: A business requires 30 days of continuous surveillance footage. When calculating storage, which formula is MOST appropriate?

Bitrate (Mbps) × 3600 seconds × 24 hours × 30 days × camera count ÷ 8 (Correct answer)
Resolution in pixels × frame rate × 30
Camera count × lens focal length × 30
Storage capacity ÷ camera count × 30

Correct answer: Bitrate (Mbps) × 3600 seconds × 24 hours × 30 days × camera count ÷ 8

Multiplying bitrate by seconds per hour, hours per day, days retained, and camera count (then dividing by 8 to convert bits to bytes) gives total storage in megabytes.

Question 40: When performing preventive maintenance on outdoor cameras, which environmental factor most commonly degrades image quality over time?

Fluctuating frame rates
Incorrect DNS settings
Moisture and condensation inside the housing (Correct answer)
DHCP lease expiration

Correct answer: Moisture and condensation inside the housing

Moisture infiltration into camera housings causes lens fogging, corrosion, and sensor damage, which are primary causes of outdoor camera degradation.

Question 41: An investigator needs to verify the NVR system clock is accurate before exporting evidence. What is the most reliable reference source for time verification?

The computer used to view the footage
Another DVR on the same network
An NTP-synchronized server or GPS time source (Correct answer)
The investigator's personal wristwatch

Correct answer: An NTP-synchronized server or GPS time source

NTP-synchronized or GPS time sources provide authoritative, traceable time references accepted as accurate in legal proceedings.

Question 42: Which amendment to the U.S. Constitution is MOST directly invoked when challenging government-conducted surveillance?

Second Amendment
Sixth Amendment
Fourth Amendment (Correct answer)
First Amendment

Correct answer: Fourth Amendment

The Fourth Amendment protects against unreasonable searches and seizures by the government, forming the constitutional basis for most challenges to government surveillance.

Question 43: Which camera technology is best suited for detecting human presence through complete darkness and smoke in an industrial environment?

Near-infrared (NIR) camera with IR illuminators
Thermal imaging camera (Correct answer)
Ultra-low lux color camera
Day/night camera with WDR

Correct answer: Thermal imaging camera

Thermal cameras detect heat signatures rather than visible or near-IR light, making them effective through complete darkness, smoke, and dust.

Question 44: Which preventive maintenance practice helps extend the lifespan of outdoor surveillance cameras in coastal environments?

Increasing recording bitrate
Using higher-resolution sensors
Installing cameras closer to ground level
Applying anti-corrosion coating to metal hardware and regularly inspecting seals (Correct answer)

Correct answer: Applying anti-corrosion coating to metal hardware and regularly inspecting seals

Salt air in coastal environments accelerates corrosion of metal mounting hardware and enclosure components, making anti-corrosion treatments and seal inspections essential.

Question 45: What does the term 'credential management' refer to in access control?

Programming the door strike release time
The lifecycle process of issuing, tracking, modifying, and revoking access credentials (Correct answer)
Calibrating biometric reader sensitivity
Physically installing card readers at entry points

Correct answer: The lifecycle process of issuing, tracking, modifying, and revoking access credentials

Credential management encompasses the entire lifecycle of access credentials — from issuance and assignment to modification and revocation.

Question 46: A proximity card reader stops responding after a nearby lightning strike. The most likely damaged component is the:

Card credential itself
Door strike mechanism
Access control software database
Reader's surge protection or internal circuitry (Correct answer)

Correct answer: Reader's surge protection or internal circuitry

Lightning-induced surges most commonly damage the reader's electronics, particularly if surge protection devices are absent or insufficient.

Question 47: What is the primary advantage of an NVR over a DVR for modern surveillance installations?

NVRs are less expensive than DVRs
NVRs process video data from IP cameras directly over the network (Correct answer)
NVRs only support analog cameras
NVRs do not require hard drives

Correct answer: NVRs process video data from IP cameras directly over the network

An NVR receives already-encoded digital video streams from IP cameras over the network, eliminating the need for analog encoding hardware.

Question 48: RAID 5 requires a minimum of how many drives?

6
2
4
3 (Correct answer)

Correct answer: 3

RAID 5 requires at least 3 drives to distribute parity data across all drives while maintaining read/write performance.

Question 49: Which of the following is a fundamental principle of intrusion detection & monitoring as it applies to Certified Surveillance Technician?

Prioritizing speed of completion over accuracy and compliance
Systematic evaluation and adherence to established industry standards (Correct answer)
Relying solely on personal experience without reference to guidelines
Avoiding documentation to streamline workflow efficiency

Correct answer: Systematic evaluation and adherence to established industry standards

A fundamental principle of intrusion detection & monitoring in Certified Surveillance Technician is the systematic evaluation and adherence to established industry standards, which ensures consistency, quality, and regulatory compliance across all professional activities.

Question 50: What is the primary ethical obligation of a CST professional when a conflict of interest arises during intrusion detection & monitoring activities?

Ignore the conflict if it does not directly affect the current task
Resolve the conflict privately without informing stakeholders
Proceed while favoring the outcome that benefits the professional personally
Disclose the conflict to all relevant parties and recuse from the decision if necessary (Correct answer)

Correct answer: Disclose the conflict to all relevant parties and recuse from the decision if necessary

The primary ethical obligation when a conflict of interest arises in intrusion detection & monitoring is to disclose it to all relevant parties and, if necessary, recuse from the decision. This maintains professional integrity and stakeholder trust.

Question 51: A surveillance system is configured for continuous recording at 1080p/15fps. What is the BEST approach to extend the retention period without adding storage hardware?

Use JPEG instead of video compression
Increase the frame rate to 30fps
Switch to a more efficient codec such as H.265 (Correct answer)
Disable all cameras during daytime hours

Correct answer: Switch to a more efficient codec such as H.265

H.265 (HEVC) provides approximately 50% better compression than H.264 at equivalent quality, effectively doubling storage efficiency.

Question 52: What distinguishes a 'holdup' alarm from a standard 'burglary' alarm in a commercial intrusion detection system?

Holdup alarms are triggered covertly by occupants under duress; burglary alarms detect unauthorized entry (Correct answer)
Holdup alarms are always silent; burglary alarms always sound audibly
Holdup alarms use wireless sensors; burglary alarms use wired sensors
Holdup alarms require police response; burglary alarms notify a guard service

Correct answer: Holdup alarms are triggered covertly by occupants under duress; burglary alarms detect unauthorized entry

Holdup (panic) alarms are activated covertly by employees when threatened by robbery, while burglary alarms respond automatically to unauthorized intrusion attempts.

Question 53: Which communication protocol is most commonly used between a card reader and an access control panel?

RS-232
RS-485
Ethernet TCP/IP
Wiegand (Correct answer)

Correct answer: Wiegand

Wiegand is the industry-standard protocol for transmitting card data from a reader to an access control panel.

Question 54: In video analytics used for intrusion detection, what is a 'virtual tripwire'?

An encrypted communication channel between cameras
A redundant recording channel that activates on motion
A software-defined line in a camera's field of view that triggers an alert when crossed (Correct answer)
A physical laser barrier connected to a camera

Correct answer: A software-defined line in a camera's field of view that triggers an alert when crossed

A virtual tripwire is a user-defined line drawn within a camera's field of view; the analytics engine triggers an alert when an object crosses the line in a specified direction.

Question 55: What is the purpose of 'anti-passback' in an access control system?

Encrypting card data transmitted over the Wiegand bus
Limiting the number of cards that can be enrolled per reader
Preventing a card from being used to exit before it has been used to enter (Correct answer)
Blocking access to all doors after a security alarm is triggered

Correct answer: Preventing a card from being used to exit before it has been used to enter

Anti-passback prevents a credential from being used to re-enter (or exit) a zone unless the corresponding entry (or exit) event was first recorded, stopping card sharing.

Question 56: In a VMS, what does the term 'failover server' describe?

A backup server that takes over recording if the primary fails (Correct answer)
A redundant network switch for camera connectivity
A server that handles high-bandwidth streams
A server dedicated to archiving old footage

Correct answer: A backup server that takes over recording if the primary fails

A failover server is a standby recording server that automatically assumes recording responsibilities if the primary server becomes unavailable, ensuring continuity.

Question 57: Which file format is commonly used for exporting surveillance footage to be played on standard media players or submitted as evidence?

RAW camera format
AVI or MP4 (Correct answer)
PSD
CSV

Correct answer: AVI or MP4

AVI and MP4 are widely supported video container formats that can be played on standard media players and accepted as evidence in legal proceedings.

Question 58: Which AI surveillance capability uses biometric data to identify individuals from camera footage?

Crowd density estimation
License plate reading
Facial recognition (Correct answer)
Motion heatmapping

Correct answer: Facial recognition

Facial recognition analyzes biometric facial features from video footage to identify or verify individuals against a database.

Question 59: What does 'bandwidth throttling' in a VMS remote viewing configuration accomplish?

Forces all remote views to use H.264 regardless of camera codec
Disables audio for remote connections
Limits the bitrate delivered to remote viewers to prevent saturating WAN links (Correct answer)
Increases frame rate for remote clients

Correct answer: Limits the bitrate delivered to remote viewers to prevent saturating WAN links

Bandwidth throttling restricts the streaming bitrate sent to remote clients, preventing video streams from overwhelming limited WAN bandwidth and ensuring network stability for other traffic.

Question 60: A technician uses a PoE tester and finds that a camera port shows 'data only' with no power output. What is the most likely cause?

The Cat6 cable is too short
The camera does not support PoE
The switch port has PoE disabled or the power budget is exhausted (Correct answer)
The camera is using an incorrect subnet mask

Correct answer: The switch port has PoE disabled or the power budget is exhausted

A port showing data but no power typically indicates PoE is administratively disabled or the switch's total power budget is already consumed.

Question 61: A seismic sensor installed on a safe would primarily detect which type of intrusion attempt?

Glass breakage in the vicinity
Motion in the surrounding room
Electromagnetic field changes near the safe
Vibrations caused by drilling or cutting on the protected object (Correct answer)

Correct answer: Vibrations caused by drilling or cutting on the protected object

Seismic sensors are tuned to detect low-frequency vibrations transmitted through solid objects, making them ideal for detecting physical attacks such as drilling or grinding on safes or vaults.

Question 62: What is the risk of using 'save as' to re-save a video file during evidence handling rather than using a verified file copy method?

Re-saving can trigger re-encoding or metadata modification, altering the file and invalidating its hash (Correct answer)
The file size will increase unnecessarily
'Save as' is always acceptable for evidence handling
The file name may change

Correct answer: Re-saving can trigger re-encoding or metadata modification, altering the file and invalidating its hash

Re-saving through software may alter codec parameters, metadata, or even pixel data depending on the application, changing the cryptographic hash and compromising integrity.

Question 63: In the context of intrusion detection & monitoring, what role does continuous professional development play for CST practitioners?

It is required only during the first year of certification
It serves primarily as a networking opportunity with no practical benefit
It ensures practitioners remain current with evolving standards, technologies, and best practices (Correct answer)
It is optional and only needed for career advancement

Correct answer: It ensures practitioners remain current with evolving standards, technologies, and best practices

Continuous professional development is essential in intrusion detection & monitoring because it ensures CST practitioners remain current with evolving standards, technologies, and best practices, maintaining competency throughout their careers.

Question 64: During a maintenance inspection, a technician discovers that camera housings on a rooftop installation have faded and cracked UV seals. What is the primary risk?

Reduced IR night vision range
Increased power consumption
Water ingress leading to equipment failure (Correct answer)
Signal interference with adjacent cameras

Correct answer: Water ingress leading to equipment failure

Cracked seals allow moisture to enter the housing, which can damage the camera's electronics, lens, and sensor over time.

Question 65: Which quality assurance method is most commonly applied in fourth amendment & privacy laws to verify that CST professional standards are being met?

Annual reviews conducted exclusively by non-technical management
Relying on client satisfaction surveys as the sole measure of quality
Informal self-assessment without external validation
Structured audits, peer reviews, and performance metrics aligned with industry benchmarks (Correct answer)

Correct answer: Structured audits, peer reviews, and performance metrics aligned with industry benchmarks

Structured audits, peer reviews, and performance metrics aligned with industry benchmarks are the most effective quality assurance methods in fourth amendment & privacy laws, providing objective, measurable evidence that CST standards are consistently met.

Question 66: A card reader is mounted at a height that is inaccessible to wheelchair users. This violates requirements under which U.S. regulation?

OSHA 1910
UL 294
NFPA 72
Americans with Disabilities Act (ADA) (Correct answer)

Correct answer: Americans with Disabilities Act (ADA)

The ADA specifies maximum reach ranges for operable controls, requiring card readers to be mounted within accessible reach for wheelchair users.

Question 67: A CST professional encounters an unfamiliar situation while performing intrusion detection & monitoring duties. What is the most appropriate first action?

Skip the task entirely and move to the next assignment
Proceed based on general assumptions to avoid delays
Consult relevant standards, guidelines, or a qualified supervisor before proceeding (Correct answer)
Apply a solution from an unrelated field without verification

Correct answer: Consult relevant standards, guidelines, or a qualified supervisor before proceeding

When facing unfamiliar situations in intrusion detection & monitoring, the most appropriate action is to consult relevant standards, guidelines, or a qualified supervisor. This ensures safety, accuracy, and compliance while building professional knowledge.

Question 68: What is the significance of the ONVIF Profile S specification in a surveillance system installation?

It certifies that IP cameras are compatible with analog DVRs through a protocol bridge
It guarantees that all ONVIF Profile S cameras will work with any NVR regardless of vendor
It defines interoperability standards for IP video streaming, PTZ control, and video analytics between devices (Correct answer)
It specifies the maximum supported resolution and frame rate for certified cameras

Correct answer: It defines interoperability standards for IP video streaming, PTZ control, and video analytics between devices

ONVIF Profile S defines a standard set of functions including video streaming, PTZ control, and event handling that enable interoperability between IP cameras and NVRs from different manufacturers.

Question 69: Which RAID level provides mirroring, meaning data is written identically to two drives simultaneously?

RAID 1 (Correct answer)
RAID 5
RAID 6
RAID 0

Correct answer: RAID 1

RAID 1 mirrors data across two drives so that if one fails, the other contains an identical copy ensuring no data loss.

Question 70: An NVR shows 'HDD Not Detected' after a fan failure event. What is the most likely explanation?

Overheating from the failed fan caused the HDD to shut down or fail (Correct answer)
A camera's IP address conflicted with the NVR
The video codec changed automatically
The NVR's firmware corrupted the partition table

Correct answer: Overheating from the failed fan caused the HDD to shut down or fail

Fan failure leads to thermal overload, which can cause hard drives to power down or suffer permanent damage from excessive heat.

Question 71: A surveillance camera positioned to monitor a neighboring property's private yard, rather than the client's own property, raises which PRIMARY legal concern?

Breach of building permit requirements
Signal interference with neighboring wireless networks
Invasion of privacy or trespass by electronic means (Correct answer)
Violation of FCC transmission regulations

Correct answer: Invasion of privacy or trespass by electronic means

Directing surveillance equipment at a neighboring property's private yard constitutes a potential invasion of privacy or tortious intrusion upon seclusion, and may violate state surveillance statutes.

Question 72: In access control, 'two-man rule' (also called dual-custody) requires:

Two authorized individuals to both present credentials before access is granted (Correct answer)
Two separate readers mounted side-by-side at a single door
A biometric scan followed by a PIN entry from the same user
Backup power to activate after the primary power fails

Correct answer: Two authorized individuals to both present credentials before access is granted

The two-man rule mandates that two separate authorized individuals must authenticate simultaneously before a highly sensitive area is unlocked.

Question 73: What is the purpose of a 'legal hold' in a surveillance storage context?

A lock placed on NVR hardware during servicing
A feature that prevents remote access to recordings
A storage encryption mode
A directive to preserve specific video records beyond normal retention for litigation (Correct answer)

Correct answer: A directive to preserve specific video records beyond normal retention for litigation

A legal hold suspends normal overwrite or deletion of specific footage to ensure it is available for potential litigation or investigation.

Question 74: What surveillance technology uses unique patterns in the iris of the eye for identification purposes?

Iris recognition biometrics (Correct answer)
Gait analysis
Facial recognition
Retinal scanning

Correct answer: Iris recognition biometrics

Iris recognition biometrics capture and analyze the unique, complex patterns in the colored part of the eye (iris) to identify individuals with very high accuracy.

Question 75: When documenting activities related to card reader & biometric access, which practice is considered essential for CST certification holders?

Keeping documentation in personal notes that are not accessible to other team members
Recording only outcomes while omitting the methods and processes used
Completing documentation only when requested by auditors or supervisors
Maintaining comprehensive records that include procedures, observations, results, and any anomalies (Correct answer)

Correct answer: Maintaining comprehensive records that include procedures, observations, results, and any anomalies

Comprehensive documentation that includes procedures, observations, results, and any anomalies is essential in card reader & biometric access. This supports quality assurance, enables peer review, and satisfies regulatory and audit requirements.

Question 76: An installer is verifying the 'walk test' of a PIR sensor. What movement pattern will produce the most reliable detection?

Crawling below the lowest detection beam
Walking directly toward the detector from the front
Walking across the detector's field of view (lateral movement) (Correct answer)
Standing still within the detection zone

Correct answer: Walking across the detector's field of view (lateral movement)

PIR detectors are most sensitive to lateral movement that crosses detection zones, maximizing the differential infrared signal as the body moves between segments of the Fresnel lens.

Question 77: What is the purpose of motion-triggered recording in a surveillance storage strategy?

To improve camera image quality during motion events
To automatically alert police when motion is detected
To enable pan-tilt-zoom on fixed cameras
To reduce storage usage by only recording when activity is detected (Correct answer)

Correct answer: To reduce storage usage by only recording when activity is detected

Motion-triggered recording conserves storage by only writing video to disk when motion is detected rather than recording continuously.

Question 78: What is the purpose of 'pre-alarm recording' (pre-buffering) in a surveillance NVR?

Record footage before an alarm event by continuously buffering video in memory (Correct answer)
Apply higher bitrates to recordings made before business hours
Delay alarm notifications to prevent false alerts
Store recordings in a secondary backup location before the primary drive fills

Correct answer: Record footage before an alarm event by continuously buffering video in memory

Pre-alarm recording (pre-buffering) continuously stores a short buffer of video in memory so that when an alarm triggers, the recording includes footage from before the triggering event.

Question 79: When pulling cable through conduit during a surveillance installation, what is the maximum fill ratio recommended to prevent cable damage and overheating?

50% fill for a single cable and 60% for multiple cables in all conduit types
No fill limit applies to low-voltage data cables in conduit
25% of the conduit's cross-sectional area for one cable, 40% for multiple cables (Correct answer)
75% fill is acceptable for low-voltage surveillance cables in any conduit

Correct answer: 25% of the conduit's cross-sectional area for one cable, 40% for multiple cables

NEC guidelines recommend no more than 25% fill for a single cable and 40% fill for multiple cables to allow for heat dissipation and ease of future cable pulls.

Question 80: What is the primary advantage of using a cellular communicator as a backup path for an alarm system?

It eliminates the need for a control panel
It provides communication even when telephone lines are cut or disabled (Correct answer)
It allows wireless sensor installation
It reduces the central station monitoring fees

Correct answer: It provides communication even when telephone lines are cut or disabled

Cellular communicators operate independently of landline infrastructure, ensuring alarm signals reach the central station even if an intruder cuts the telephone lines.

Question 81: A central monitoring station receives a 'troubles' signal from an alarm panel. What does this signal typically indicate?

A successful arm/disarm event
A duress alarm triggered by the user
An active intrusion alarm
A system fault condition such as low battery, AC power loss, or communication failure (Correct answer)

Correct answer: A system fault condition such as low battery, AC power loss, or communication failure

Trouble signals indicate supervisory fault conditions within the system—such as low battery, loss of AC power, or a zone fault—rather than an active intrusion event.

Question 82: What is the first step in troubleshooting a surveillance system malfunction?

Call for professional help.
Identify and isolate the issue. (Correct answer)
Perform a system reboot.
Replace the malfunctioning component.

Correct answer: Identify and isolate the issue.

The first step in troubleshooting any surveillance system malfunction is to identify and isolate the issue. This systematic approach helps pinpoint the exact problem component or area, preventing unnecessary actions and guiding the technician towards an efficient and targeted solution.

Question 83: What is the primary purpose of a camera housing's IP66 rating in a surveillance installation?

It indicates the camera supports 6 megapixel resolution
It specifies the maximum operating temperature of 66°C
It denotes compatibility with 6 PoE standards
It certifies protection against powerful water jets and dust ingress (Correct answer)

Correct answer: It certifies protection against powerful water jets and dust ingress

IP66 is an ingress protection rating where the first digit (6) means dust-tight and the second digit (6) means protection against powerful water jets.

Question 84: Which intrusion detection standard governs the grading of alarm systems for residential and commercial applications in the United States?

ANSI/SIA CP-01 (Correct answer)
UL 2050
UL 681
IEC 60839

Correct answer: ANSI/SIA CP-01

ANSI/SIA CP-01 is the Control Panel Standard that defines false alarm reduction features and grading criteria widely adopted by AHJs across the United States.

Question 85: The Stored Communications Act (SCA), part of ECPA, governs access to:

Video surveillance footage held by private businesses
Emails and other communications stored by electronic service providers (Correct answer)
Pen register data collected by ISPs
Real-time audio surveillance in workplaces

Correct answer: Emails and other communications stored by electronic service providers

The SCA protects the privacy of stored wire and electronic communications held by third-party service providers such as email hosts.

Question 86: During a surveillance installation, you discover that the total cable run to a distant camera will be 320 feet of Cat6. What is the likely concern?

Copper cable cannot support PTZ camera control beyond 300 feet
The run exceeds the 328-foot (100m) Ethernet specification limit (Correct answer)
PoE cannot function at distances greater than 200 feet
Cat6 cannot carry video signals beyond 100 feet

Correct answer: The run exceeds the 328-foot (100m) Ethernet specification limit

The IEEE 802.3 Ethernet standard limits copper UTP cable runs to 328 feet (100 meters), beyond which signal degradation can cause connectivity issues.

Question 87: A mantrap (or airlock) is used in physical security to:

Control access by allowing only one person to pass between two interlocked doors at a time (Correct answer)
Prevent electromagnetic interference from entering server rooms
Monitor card reader health via OSDP supervision
Store backup credentials offline

Correct answer: Control access by allowing only one person to pass between two interlocked doors at a time

A mantrap uses two interlocked doors so that the first must close and verify before the second opens, preventing tailgating and piggybacking.

Question 88: Under the UL 681 standard for installation of burglar and holdup alarm systems, what minimum wire gauge is typically required for detection circuit wiring?

16 AWG
14 AWG
18 AWG
22 AWG (Correct answer)

Correct answer: 22 AWG

UL 681 generally specifies a minimum of 22 AWG conductors for detection (zone) wiring in burglar alarm installations.

Question 89: Which storage technology is increasingly used in surveillance NVRs because it has no moving parts and faster read speeds?

Floppy disk
Magnetic tape
Optical disc (Blu-ray)
Solid-state drive (SSD) (Correct answer)

Correct answer: Solid-state drive (SSD)

SSDs offer faster read/write speeds, lower latency, and greater shock resistance compared to traditional HDDs for surveillance applications.

Question 90: A balanced magnetic switch (BMS) is used instead of a standard door contact primarily to resist which attack method?

High-temperature environments that demagnetize standard contacts
RF interference that mimics a closed-contact signal
Magnetic field spoofing used to defeat standard reed switches (Correct answer)
Physical forcing of the door

Correct answer: Magnetic field spoofing used to defeat standard reed switches

A BMS uses a biased magnetic field that requires a specific magnetic signature to remain in the secure state, making it resistant to defeat by an external magnet placed near a standard reed switch.

Question 91: In surveillance storage planning, what does 'retention period' refer to?

The time it takes to retrieve a video clip
The length of time recorded footage is kept before being overwritten or deleted (Correct answer)
The warranty period for the DVR/NVR
The duration of a single camera's recording session

Correct answer: The length of time recorded footage is kept before being overwritten or deleted

Retention period defines how long video footage is stored before the system automatically overwrites or purges it.

Question 92: What is the primary function of an analog-to-digital encoder (video encoder) in a surveillance system?

Convert analog camera signals into digital IP streams for network transmission (Correct answer)
Convert digital IP camera streams to analog format for legacy DVRs
Compress H.264 streams to H.265 format
Amplify analog signals over long coaxial cable runs

Correct answer: Convert analog camera signals into digital IP streams for network transmission

A video encoder converts analog camera signals into digital IP streams, allowing legacy analog cameras to integrate into modern IP-based surveillance networks.

Question 93: Under US federal guidelines, what should a surveillance system operator do with footage that may be evidence in a legal investigation?

Delete it to protect privacy
Overwrite it after 24 hours per standard policy
Preserve it beyond the normal retention period and document the chain of custody (Correct answer)
Compress it to the lowest quality to save space

Correct answer: Preserve it beyond the normal retention period and document the chain of custody

Footage relevant to a legal matter must be preserved as evidence with documented chain of custody, regardless of normal retention schedules.

Question 94: During system commissioning, a technician discovers that two cameras on the same NVR display a 'video loss' alarm intermittently. What is the best first troubleshooting step?

Upgrade the NVR firmware to the latest version to resolve intermittent video loss bugs
Replace both cameras immediately as simultaneous failure indicates a manufacturing defect
Check the switch port status and cable continuity for both cameras to identify a shared infrastructure issue (Correct answer)
Perform a factory reset on the NVR to clear any firmware corruption causing false alarms

Correct answer: Check the switch port status and cable continuity for both cameras to identify a shared infrastructure issue

When two cameras fail simultaneously, the likely cause is a shared infrastructure component such as a switch, PoE injector, or cable path, so checking these first is most efficient.

Question 95: What does a False Acceptance Rate (FAR) measure in biometric systems?

The percentage of unauthorized users incorrectly granted access (Correct answer)
The time required to process a biometric scan
The rate at which biometric templates expire
The percentage of valid users incorrectly denied access

Correct answer: The percentage of unauthorized users incorrectly granted access

FAR measures how often an unauthorized individual is incorrectly accepted by the biometric system, representing a security failure.

Question 96: Which of the following is a fundamental principle of evidence export & timestamping as it applies to Certified Surveillance Technician?

Relying solely on personal experience without reference to guidelines
Systematic evaluation and adherence to established industry standards (Correct answer)
Avoiding documentation to streamline workflow efficiency
Prioritizing speed of completion over accuracy and compliance

Correct answer: Systematic evaluation and adherence to established industry standards

A fundamental principle of evidence export & timestamping in Certified Surveillance Technician is the systematic evaluation and adherence to established industry standards, which ensures consistency, quality, and regulatory compliance across all professional activities.

Question 97: How can wireless surveillance systems be affected by environmental factors?

They are only affected by extreme weather conditions.
They can be disrupted by interference, obstructions, or poor signal strength. (Correct answer)
They work better in remote areas without a signal.
Wireless systems are unaffected by environmental factors.

Correct answer: They can be disrupted by interference, obstructions, or poor signal strength.

Wireless surveillance systems can be significantly affected by environmental factors such as interference, obstructions, and poor signal strength. Walls, other electronic devices, and distance can degrade the wireless signal, leading to unreliable connections, intermittent video feeds, or complete loss of communication.

Question 98: What is the main reason surveillance cameras should NOT be aimed directly at light sources such as the sun or bright lamps?

It reduces the camera's IP rating
It can permanently damage the image sensor (Correct answer)
It interferes with IR illuminators
It causes the camera to overheat

Correct answer: It can permanently damage the image sensor

Direct exposure to intense light sources can cause irreversible blooming or burn-in damage to the image sensor, permanently degrading image quality.

Question 99: What is the function of a 'request-to-exit' (REX) device in an access control system?

It triggers a lockdown when motion is detected near a door
It signals the panel to unlock the door for egress without using a credential (Correct answer)
It reboots the card reader after a failed read
It prevents re-entry using the same card within a set time window

Correct answer: It signals the panel to unlock the door for egress without using a credential

A REX device (motion sensor or push button) signals the access control panel to release the door latch for egress, allowing exit without a card swipe.

Question 100: What is role-based access control (RBAC) in the context of a surveillance system?

A storage compression format
A type of motion detection algorithm
A method of configuring camera angles remotely
Assigning specific permissions to users based on their job function (Correct answer)

Correct answer: Assigning specific permissions to users based on their job function

RBAC limits each user's access to only the features and data necessary for their role, reducing insider threat risk.

Certified Surveillance Technician (CST)

The CST certification validates proficiency in designing, installing, and maintaining electronic surveillance systems including CCTV cameras, access control, intrusion detection, network security, and digital storage solutions. It covers the full scope of skills required for professional surveillance technicians across physical security and IP-based systems.

100

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds