AP Cybersecurity Drill 7: Door-Access Logs and Camera Coverage

Question 1. How many times was an entry attempt denied at the cage door that evening?

• A) Two
• B) One
• C) Three ✓
• D) Four in the access log shown

Explanation: Choice C is correct. The log shows three rows with Direction Entry and Result Denied, all from badge B-118 at 19:31, 19:31, and 19:32, so the denied-entry count is three. Choice A is incorrect. Two undercounts the denied rows; there are three. Choice B is incorrect. One counts only a single denial and ignores the other two. Choice D is incorrect. Four overcounts; only three rows are denials, and the granted entries are not denials.

Question 2. Which evidence most strongly suggests that the 19:46 granted entry may not have been made by the legitimate cardholder?

• A) Badge B-204 was also used to enter earlier in the evening, at 18:02, before the run
• B) Badge B-118 was the badge used at 19:31, a little before the 19:46 entry occurred
• C) The cage door is monitored by only one camera covering the approach aisle
• D) Badge B-204 entered at 19:46 while its owner reported being away on a delivery run ✓

Explanation: Choice D is correct. The supervisor who holds B-204 says they were away from about 19:15 to 20:30, yet B-204 was used to enter at 19:46, so the credential was used while its owner says they were elsewhere, which points to misuse of that badge. Choice A is incorrect. The 18:02 entry falls before the reported away-window and looks like normal use, so it is not the suspicious event. Choice B is incorrect. The B-118 attempts were denied, so they did not result in entry; they are notable but did not open the door. Choice C is incorrect. Limited camera coverage is a gap in evidence, not itself proof about who used a badge.

Question 3. The three rapid denied attempts from B-118 just before the 19:46 entry are most consistent with which of the following?

• A) Someone trying a badge that lacks cage access before a different, working badge was used ✓
• B) A routine end-of-shift change that the badge system automatically records as denied entries
• C) A maintenance technician testing the aisle camera, which registers as denied door attempts
• D) The badge reader briefly losing power and logging the gap as several denied attempts

Explanation: Choice A is correct. Several quick denials from one badge that has no access, immediately followed by a successful entry on a different badge, fits an attempt to get in with an unauthorized card and then resorting to one that works. Choice B is incorrect. A routine shift change would not appear as repeated denied entry attempts at one door. Choice C is incorrect. Camera testing would not generate denied badge-entry rows in the door log. Choice D is incorrect. If the reader had lost power it would not record Denied results at all.

Question 4. Why does the camera's coverage limit the strength of the conclusion the analyst can draw?

• A) Because the cage camera is configured to capture footage only during posted daytime business hours
• B) Because the camera covers the aisle but not the cage interior, so it cannot show what was taken inside ✓
• C) Because camera footage of this particular kind is never admissible as evidence in any internal review
• D) Because the cage camera and the door badge reader each run on a separate clock that the two simply cannot reconcile

Explanation: Choice B is correct. The camera shows the approach but not inside the cage, so it can place people at the door yet cannot establish what they did with the inventory, which is exactly the missing link. Choice A is incorrect. Nothing in the stimulus says the camera is limited to business hours, and the relevant footage at 19:46 was captured. Choice C is incorrect. The limit here is the camera's field of view, not any blanket rule about admissibility. Choice D is incorrect. The stimulus gives no indication of mismatched clocks; the gap is the camera's physical coverage.

Question 5. Which change would most directly close the biggest evidence and access-control gaps revealed by this incident?

• A) Require longer badge identifier numbers so that the cage badges become much harder for outsiders to copy
• B) Add an interior cage camera plus an anti-piggybacking control such as a held-open alarm or a vestibule ✓
• C) Email the entire warehouse staff a written reminder that each of them must badge in individually each time
• D) Replace the existing cage door with a noticeably heavier and more solidly built reinforced security door

Explanation: Choice B is correct. Interior camera coverage would show what happens inside the cage, and an anti-piggybacking/tailgating control such as a door-held-open alarm or an access control vestibule addresses the held-door behavior seen at 19:46. Choice A is incorrect. Longer badge numbers do nothing about the blind spot inside the cage or the held door. Choice C is incorrect. A reminder relies on behavior and does not capture what happens inside the cage. Choice D is incorrect. A heavier door does not improve visibility or stop a badged person from holding the door for another.