I85PREP
⌘ K
Punjab PSEB Sr. Sec. NSQF Private Security (CCTV Video Footage Auditor) study materials
Punjab PSEB Sr. Sec. NSQF Private Security (CCTV Video Footage Auditor) study resources

Punjab PSEB Sr. Sec. NSQF Private Security (CCTV Video Footage Auditor) practice questions

One question at a time. Build your Punjab PSEB Sr. Sec. NSQF Private Security (CCTV Video Footage Auditor) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1CCTV systems and video surveillance fundamentals

In a PAL analogue CCTV system, what is the standard frame rate used for recording and playback?

  1. 60 frames per second
  2. 25 frames per second Correct answer.
  3. 30 frames per second
  4. 50 frames per second

Explanation

PAL is a 50 Hz television standard, so it delivers 25 full frames per second through interlaced fields. NTSC regions instead use 30 frames per second. An auditor must know the native frame rate of the source system because it determines the expected inter-frame interval and helps detect dropped or duplicated frames.

Question 2CCTV systems and video surveillance fundamentals

A DVR specification lists a recording resolution of D1. Which pixel dimension does D1 correspond to in PAL?

  1. 720 x 576 Correct answer.
  2. 640 x 480
  3. 352 x 288
  4. 1280 x 720

Explanation

In PAL systems D1 resolution is 720 x 576 pixels, matching the full SD frame. The 640 x 480 figure is the NTSC D1 dimension, and CIF in PAL is 352 x 288. Auditors use these standard labels to verify whether footage was recorded at full or reduced resolution.

Question 3CCTV systems and video surveillance fundamentals

Which type of camera lens produces a much wider field of view, making it suitable for covering an entire room from one corner?

  1. Telephoto lens
  2. Varifocal lens set to maximum zoom
  3. Fisheye lens Correct answer.
  4. Pinhole lens

Explanation

A fisheye lens has an extremely short focal length and captures a very wide hemispherical view, often over 180 degrees. Telephoto and zoomed varifocal lenses narrow the view to distant subjects. Pinhole lenses are chosen for concealment, not for wide-area coverage.

Question 4CCTV systems and video surveillance fundamentals

What is the primary function of a multiplexer in a traditional analogue DVR?

  1. To combine multiple camera inputs into a single recording and display stream Correct answer.
  2. To amplify the audio signal from a microphone
  3. To supply power to the cameras over coaxial cable
  4. To convert digital IP packets into analogue video

Explanation

A multiplexer lets several camera feeds share one recording and display path by time-slicing or splitting the frame. This is why analogue DVRs can show a quad view while still recording all channels. It does not handle power distribution or IP-to-analogue conversion.

Question 5CCTV systems and video surveillance fundamentals

Which storage technology is most commonly used inside modern NVRs and DVRs for continuous video retention?

  1. Hard disk drive (HDD) Correct answer.
  2. Optical Blu-ray disc
  3. Magnetic tape cartridge
  4. Solid state drive (SSD)

Explanation

Surveillance recorders use hard disk drives because they offer large capacity at low cost per terabyte and support continuous overwrite cycles. SSDs are costly for bulk retention, while optical and tape media are not suited to constant random-access recording.

Question 6CCTV systems and video surveillance fundamentals

In CCTV terminology, what does the abbreviation PoE stand for?

  1. Pixel over Exposure
  2. Protocol over Encoder
  3. Power over Ethernet Correct answer.
  4. Port of Entry

Explanation

PoE means Power over Ethernet, a standard that carries both data and electrical power to an IP camera through a single network cable. It simplifies installation by removing the need for a separate local power supply at each camera. The other expansions are invented terms.

Question 7CCTV systems and video surveillance fundamentals

What is the main purpose of setting a motion detection mask or privacy mask on a camera?

  1. To increase the camera frame rate in that area
  2. To exclude selected areas of the scene from detection or viewing Correct answer.
  3. To improve the infrared range of the camera
  4. To reduce the storage capacity of the hard disk

Explanation

A privacy or motion mask blocks chosen regions of the image so they are not recorded, displayed, or used to trigger events. This protects private areas such as neighbouring windows. It has no effect on frame rate, infrared range, or disk capacity.

Question 8CCTV systems and video surveillance fundamentals

Which video compression standard is specifically designed for efficient transmission of surveillance video over limited bandwidth?

  1. MJPEG
  2. JPEG 2000
  3. MPEG-1
  4. H.264 Correct answer.

Explanation

H.264 provides high compression efficiency through inter-frame prediction and is widely adopted in IP cameras and NVRs. JPEG 2000 and MJPEG compress each frame independently, producing larger streams. MPEG-1 is an older standard not favoured for modern surveillance.

Question 9CCTV systems and video surveillance fundamentals

An auditor finds that a DVR's timestamp drifts by several minutes over a month. Which configuration issue most likely explains this?

  1. The recorder is not synchronised to a network time source Correct answer.
  2. The hard disk is nearly full
  3. The monitor resolution is set too low
  4. The camera lens is out of focus

Explanation

Timestamp drift usually occurs when a recorder relies only on its internal clock without periodic synchronisation to an NTP server. Over weeks the oscillator error accumulates. Lens focus, disk usage, and monitor resolution do not affect the recorded time.

Question 10CCTV systems and video surveillance fundamentals

When exporting CCTV footage for evidential use, why should the original file's hash value be calculated before transfer?

  1. To increase the playback frame rate
  2. To convert the video into a playable format
  3. To reduce the file size for easier transfer
  4. To prove the exported copy matches the original without alteration Correct answer.

Explanation

A cryptographic hash acts as a digital fingerprint; if the hash of the exported copy matches the original, integrity is demonstrated. This supports the chain of custody and admissibility. Hashing does not compress, convert, or change playback speed.

Question 11CCTV systems and video surveillance fundamentals

An NVR records 16 cameras at 4 Mbps each. Approximately how much storage is needed for 24 hours of continuous recording, ignoring overhead?

  1. About 5.5 TB
  2. About 43 GB
  3. About 86 GB
  4. About 691 GB Correct answer.

Explanation

Each camera produces 4 Mbps, so 16 cameras give 64 Mbps. Multiplying 64 Mbps by 86,400 seconds yields about 5.53 terabits, which is roughly 691 gigabytes. The other figures either ignore the camera count or misplace the decimal.

Question 12CCTV systems and video surveillance fundamentals

What is the key difference between a DVR and an NVR in terms of camera connection?

  1. A DVR records only audio, while an NVR records only video
  2. A DVR supports higher resolution than any NVR
  3. A DVR accepts analogue camera inputs, while an NVR receives IP streams over a network Correct answer.
  4. A DVR requires no storage, while an NVR requires a hard disk

Explanation

A DVR digitises and records analogue video from coax-connected cameras, whereas an NVR records digital streams from IP cameras across a network. Both record video and audio and both use storage. Resolution capability depends on the model, not the category.

Question 13CCTV systems and video surveillance fundamentals

An auditor notices that a subject's face appears smeared and duplicated across two consecutive frames during fast movement. What is the most likely cause?

  1. Insufficient hard disk capacity
  2. A faulty network switch
  3. Incorrect camera white balance
  4. Interlacing artefacts from recording in a field-based format Correct answer.

Explanation

Interlaced video captures odd and even fields at slightly different moments, so fast motion produces combing or duplicated edges. De-interlacing during playback can smear the image further. Disk capacity, white balance, and network faults do not create this field-based artefact.

Question 14CCTV systems and video surveillance fundamentals

What does the term 'chain of custody' require when handling CCTV footage evidence?

  1. A copy of the camera manufacturer's warranty
  2. A list of all cameras installed on the premises
  3. A documented record of every person who accessed or transferred the footage Correct answer.
  4. A diagram of the network cabling

Explanation

Chain of custody is a chronological record showing who handled the evidence, when, and for what purpose, ensuring it has not been tampered with. Camera inventories, warranties, and cabling diagrams may support an investigation but are not the custody record itself.

Question 15CCTV systems and video surveillance fundamentals

Which factor most directly determines the amount of detail an auditor can resolve on a distant subject's face?

  1. The length of the power cable
  2. Pixels per metre on the subject, determined by resolution and field of view Correct answer.
  3. The colour of the camera housing
  4. The brand of the monitor used for playback

Explanation

Identification depends on pixel density on the target, which combines sensor resolution with the lens field of view and distance. Housing colour, monitor brand, and cable length do not change the captured pixel density. This is the basis of the pixel-density approach to camera planning.

Question 16CCTV systems and video surveillance fundamentals

In an IP surveillance system, what is the role of the ONVIF standard?

  1. It specifies the voltage for analogue cameras
  2. It provides a common interface so devices from different manufacturers can interoperate Correct answer.
  3. It sets the legal retention period for CCTV footage
  4. It defines the maximum hard disk size for NVRs

Explanation

ONVIF is an open industry forum that publishes interface specifications allowing IP cameras, recorders, and software from different vendors to work together. It does not regulate storage size, legal retention, or analogue voltages. Interoperability is central to auditing mixed-brand systems.

Question 17CCTV systems and video surveillance fundamentals

A recorder shows a gap of exactly one minute in the timeline every night at the same time. What is the most probable explanation?

  1. The audio cable is disconnected
  2. The monitor is set to the wrong input
  3. The camera lens is dirty
  4. A scheduled maintenance or reboot task is interrupting recording Correct answer.

Explanation

A recurring gap at a fixed time strongly suggests a scheduled task such as automatic reboot, firmware check, or archive job that halts recording briefly. Lens dirt, monitor input, and audio cabling would not produce a precise, repeatable timeline gap.

Question 18CCTV systems and video surveillance fundamentals

What does the term 'frame rate' describe in a CCTV recording?

  1. The storage capacity of the hard disk
  2. The number of complete images captured per second Correct answer.
  3. The number of cameras connected to the recorder
  4. The brightness level of the infrared illuminator

Explanation

Frame rate is the count of full images, or frames, recorded each second and directly affects motion smoothness. Camera count, disk capacity, and infrared brightness are unrelated parameters. Auditors check frame rate to confirm footage is smooth enough for identifying moving subjects.

Question 19CCTV systems and video surveillance fundamentals

Which statement best describes the difference between CIF and 4CIF resolution in PAL video?

  1. CIF and 4CIF are identical in resolution
  2. 4CIF refers to audio quality, not resolution
  3. 4CIF has four times the pixel area of CIF Correct answer.
  4. CIF has four times the pixel area of 4CIF

Explanation

PAL CIF is 352 x 288 pixels, while 4CIF is 704 x 576, which is exactly four times the pixel count. The other statements invert or misrepresent the relationship. Recognising this ratio helps auditors judge whether footage was recorded at reduced quality.

Question 20CCTV systems and video surveillance fundamentals

An auditor needs to verify that exported footage has not been altered since seizure. Which method provides the strongest technical assurance?

  1. Comparing the cryptographic hash of the exported file with the hash recorded at seizure Correct answer.
  2. Viewing the footage on a different monitor
  3. Asking the operator to confirm the file is unchanged
  4. Checking the file's creation date in the operating system

Explanation

A matching cryptographic hash demonstrates that the file's contents are bit-for-bit identical to the recorded original. File dates can be edited, monitor viewing proves nothing about integrity, and verbal confirmation is not verifiable. Hashing is therefore the strongest technical check.

Question 21CCTV systems and video surveillance fundamentals

A camera's field of view is 6 metres wide at a distance of 12 metres. If the camera records at 1920 pixels horizontally, approximately how many pixels per metre fall on a subject at that distance?

  1. 320 pixels per metre Correct answer.
  2. 80 pixels per metre
  3. 160 pixels per metre
  4. 640 pixels per metre

Explanation

Dividing 1920 pixels by the 6-metre field width gives 320 pixels per metre at the subject plane. This pixel density is the figure used to judge whether facial identification is feasible. The other values result from using the wrong divisor or doubling the result.

Question 22CCTV systems and video surveillance fundamentals

During review, an auditor finds that the recorder's clock was set to local time while the incident log uses UTC. What is the correct approach to reconcile the timeline?

  1. Apply the known time-zone offset to convert the recorder time to UTC Correct answer.
  2. Change the incident log to match the recorder
  3. Discard the footage as unreliable
  4. Assume the recorder was correct and ignore the log

Explanation

When two sources use different time bases, the auditor applies the documented offset to align them on a single reference such as UTC. Ignoring the discrepancy, discarding evidence, or altering the log would compromise accuracy. The offset must itself be recorded for transparency.

Question 23CCTV systems and video surveillance fundamentals

An investigator needs to identify a person's face from footage where the subject occupies only 40 pixels between the eyes. What is the most defensible conclusion?

  1. The footage should be accepted because any face image is adequate
  2. The footage is ideal for positive identification
  3. The footage is likely insufficient for reliable facial identification Correct answer.
  4. The footage can be enhanced by zooming to create new detail

Explanation

Established pixel-density guidance treats roughly 40 pixels between the eyes as the threshold for possible recognition, and identification generally requires substantially more. Zooming cannot create detail that was never captured. Claiming positive identification from such footage would be indefensible.

Question 24CCTV systems and video surveillance fundamentals

A DVR overwrites recordings in a ring buffer. An incident occurred 45 days ago, but the retention period is 30 days. What is the likely status of the footage?

  1. It is stored in a separate archive by default
  2. It is preserved automatically because it is important
  3. It has probably been overwritten and is unavailable Correct answer.
  4. It can be recovered by increasing the monitor brightness

Explanation

A ring buffer continuously overwrites the oldest footage once capacity is reached, so anything older than the retention period is normally gone. Recorders do not automatically preserve incidents unless a manual or scheduled archive was made. Brightness adjustment cannot recover erased data.

Question 25CCTV systems and video surveillance fundamentals

Two cameras cover the same corridor. Camera A records at 25 fps and Camera B at 12 fps. How should the auditor interpret a one-second event visible on both feeds?

  1. Frame rate has no effect on the number of images of the event
  2. Both cameras will show an identical number of frames
  3. Camera A will show more intermediate frames of the event than Camera B Correct answer.
  4. Camera B will show more intermediate frames because it saves bandwidth

Explanation

At 25 fps, a one-second event is captured in about 25 frames, while at 12 fps only about 12 frames are captured. The higher frame rate therefore provides more intermediate images and smoother motion. Lower frame rate does not increase the number of frames.

Question 26CCTV systems and video surveillance fundamentals

In a CCTV installation, what does the abbreviation IR-cut refer to on a day/night camera?

  1. A lens coating that reduces glare from vehicle headlights at night
  2. An infrared illuminator built into the housing that lights a scene up to 30 metres away
  3. A mechanical filter that blocks infrared light during daylight so colours render correctly, then moves aside at night Correct answer.
  4. A recorder setting that switches from colour to monochrome playback automatically

Explanation

The IR-cut filter sits in front of the image sensor and removes the infrared component of daylight, which would otherwise tint the picture and upset the colour balance. When light falls below a set threshold the filter is mechanically withdrawn so the sensor can use near-infrared energy from IR LEDs, giving a monochrome night image.

Question 27CCTV systems and video surveillance fundamentals

An auditor reviewing a fixed camera's coverage finds that a person standing 15 metres away occupies only about 60 pixels between the eyes. Which statement best describes what this footage can support?

  1. It can support general description of clothing and build but not reliable facial identification Correct answer.
  2. It is sufficient for identification only if the footage is played at half speed
  3. It is sufficient for facial identification because 60 pixels exceeds the minimum for court presentation
  4. It is unusable for any purpose and should be excluded from the audit entirely

Explanation

Reliable facial identification generally requires a much larger inter-pupillary pixel count than 60, so this footage supports only coarse description of the subject. Auditors should state the limitation explicitly rather than overstate what the recording proves.

Question 28CCTV systems and video surveillance fundamentals

Which description correctly distinguishes a fixed focal-length lens from a varifocal lens on a surveillance camera?

  1. A fixed lens can zoom remotely from the recorder, while a varifocal lens cannot
  2. A varifocal lens records only in monochrome, while a fixed lens records in colour
  3. A fixed lens has one set angle of view, while a varifocal lens allows the angle of view to be adjusted during installation Correct answer.
  4. A fixed lens always produces higher resolution than a varifocal lens

Explanation

A fixed lens has a single focal length and therefore a single field of view that cannot be changed. A varifocal lens lets the installer adjust focal length, and thus the angle of view, at commissioning time, after which it is usually locked with a set screw.

Question 29CCTV systems and video surveillance fundamentals

An auditor is asked to review footage from a camera whose recorder was configured with a continuous recording schedule plus event-triggered recording at higher frame rate. During review, the timeline shows short segments at 25 fps interleaved with long stretches at 8 fps. What is the most reasonable interpretation?

  1. The lower-rate stretches are corrupted frames that should be discarded from the audit
  2. The camera was rebooted each time the frame rate changed
  3. The higher-rate segments correspond to motion events, and the lower-rate stretches are the continuous baseline Correct answer.
  4. The recorder is faulty because frame rate must remain constant across a single camera stream

Explanation

Many recorders keep a low frame rate for continuous recording and boost frame rate or quality when an event triggers, so mixed frame rates on one timeline are expected. The auditor should map the high-rate segments to the event log before drawing conclusions about the incident.

Question 30CCTV systems and video surveillance fundamentals

A recorder's specification states H.265 compression with a GOP length of 50 at 25 fps. During fast motion an auditor sees blocky artefacts that persist for about two seconds. Which explanation best fits this behaviour?

  1. Inter-frame prediction means an error in a reference frame is carried forward through dependent frames until the next keyframe Correct answer.
  2. The artefacts come from the monitor's refresh rate rather than from the compression
  3. Only every 50th frame is stored, and the intervening frames are interpolated by the player
  4. Each frame is compressed independently, so artefacts cannot persist beyond one frame

Explanation

With inter-frame compression, P and B frames are predicted from earlier reference frames, so a disturbance in a reference frame propagates to dependent frames until the next I-frame refreshes the picture. A GOP of 50 at 25 fps means a keyframe roughly every two seconds, matching the observed persistence.

Question 31Video footage retrieval, storage media and chain of custody

In a CCTV video footage audit, what does the term 'chain of custody' primarily document?

  1. The camera resolution settings used at the time of recording
  2. The chronological record of who handled the footage, when, and under what conditions Correct answer.
  3. The electrical load on the NVR power supply
  4. The number of frames per second stored in the DVR

Explanation

Chain of custody is the documented, unbroken history of evidence from seizure to production in court. It records every transfer, handler identity, time, and storage condition so authenticity can be defended. Resolution, frame rate, and power load are technical recording parameters, not custody records.

Question 32Video footage retrieval, storage media and chain of custody

When exporting CCTV footage for evidentiary use, which practice best preserves its integrity?

  1. Transferring the file through a personal messaging application
  2. Renaming the file to the incident date for easy identification
  3. Editing the clip to remove irrelevant minutes before copying
  4. Copying the export to a fresh write-once medium and recording a hash value Correct answer.

Explanation

A write-once medium plus a cryptographic hash allows later verification that the export is bit-for-bit unchanged. Hash comparison is the standard integrity check accepted in audits and courts. Editing, renaming, or using lossy messaging channels undermines provable integrity.

Question 33Video footage retrieval, storage media and chain of custody

A DVR is configured for continuous recording with automatic overwrite. What is the main evidential risk this creates for an auditor?

  1. The DVR clock will automatically reset to factory time
  2. The network switch will drop frames during export
  3. Older footage may be overwritten before it is retrieved Correct answer.
  4. Camera lenses will lose focus over time

Explanation

Automatic overwrite means the storage buffer cycles, so footage older than the retention window is permanently lost. An auditor must retrieve and preserve relevant footage before the overwrite cycle reaches it. Clock reset, lens focus, and switch behaviour are separate issues not caused by overwrite configuration.

Question 34Video footage retrieval, storage media and chain of custody

Which detail must appear on a footage seizure memo to make the chain of custody defensible?

  1. The number of cameras installed in the building
  2. Date, time, location, device identifier, and name of the person seizing Correct answer.
  3. The name of the security guard's supervisor
  4. The brand of the monitor used in the control room

Explanation

A seizure memo must identify the item, the exact time and place of seizure, the source device, and the seizing officer. These elements let any later reviewer trace the item back to its origin. Monitor brand, camera count, and supervisor names do not establish custody of the specific footage.

Question 35Video footage retrieval, storage media and chain of custody

An auditor receives a hard disk said to contain original CCTV footage. What is the safest first action?

  1. Image the disk and work only from the verified image copy Correct answer.
  2. Delete old partitions to free space for the export
  3. Play the footage directly from the original disk repeatedly
  4. Run a defragmentation utility on the disk to improve access

Explanation

Forensic imaging captures the disk contents without altering the original, and the original is then sealed. All analysis proceeds on the image so the source remains pristine for verification. Playing, defragmenting, or deleting partitions modifies the original medium.

Question 36Video footage retrieval, storage media and chain of custody

What does a SHA-256 hash of a video export allow an auditor to demonstrate?

  1. That the recording was made by an approved camera model
  2. That the file has been compressed to a smaller size
  3. That the video plays correctly on any media player
  4. That the file content is identical to the version hashed earlier Correct answer.

Explanation

A cryptographic hash is a fixed-length fingerprint of the file content; any change produces a different hash. Matching hashes therefore prove the file is unchanged since hashing. Playback compatibility, camera approval, and compression are not proven by a hash.

Question 37Video footage retrieval, storage media and chain of custody

Which storage medium is generally preferred for archiving a verified CCTV export for long-term evidentiary use?

  1. A shared network drive with open write access
  2. A write-once optical disc stored in controlled conditions Correct answer.
  3. A rewritable USB drive kept in the guard room drawer
  4. A temporary folder on the DVR's own internal disk

Explanation

Write-once optical media cannot be silently altered after burning and, when stored away from heat and light, remain stable for long periods. Rewritable, internal, and open shared storage all permit later modification. Controlled storage also limits environmental degradation.

Question 38Video footage retrieval, storage media and chain of custody

During retrieval, an auditor notices the DVR clock is 12 minutes ahead of the actual time. How should this be handled in the audit report?

  1. Adjust the footage timestamps in the exported file
  2. Re-record the events with a different camera to get correct times
  3. Ignore the difference because DVR clocks are never accurate
  4. Record the observed offset and state the corrected times for events Correct answer.

Explanation

Clock offset must be documented and applied transparently so event times in the report align with real-world records. Stating the measured offset preserves the audit trail. Ignoring it, altering the file, or re-recording destroys reliability.

Question 39Video footage retrieval, storage media and chain of custody

Which action breaks the chain of custody during transport of a footage disk from a site to the audit office?

  1. Obtaining a signed handover receipt at arrival
  2. Storing the bag in a locked evidence locker on arrival
  3. Recording the seal number before departure
  4. Leaving the sealed evidence bag unattended in an unlocked vehicle Correct answer.

Explanation

Unattended, unsecured access creates an unaccounted period in which the evidence could have been tampered with. Every moment of custody must be attributable to a responsible person. Recording seals, obtaining receipts, and locked storage all strengthen the chain.

Question 40Video footage retrieval, storage media and chain of custody

An NVR stores footage in a proprietary format. What is the correct audit approach when the player software is unavailable?

  1. Rename the files with a common extension and open them in a media player
  2. Convert the files using an online converter and discard the originals
  3. Use a validated forensic tool to extract and document the proprietary data Correct answer.
  4. Conclude that the footage is unusable and close the audit

Explanation

Proprietary containers can be decoded with validated forensic tools that read the raw stream and log every action. The method and tool version must be recorded so results are reproducible. Renaming, online conversion, or premature closure risks data loss and unreliability.

Question 41Video footage retrieval, storage media and chain of custody

Why should an auditor record the make, model, serial number, and firmware version of the recorder during retrieval?

  1. To prove the source device and support later verification of extraction behaviour Correct answer.
  2. To determine how many staff are needed to lift the unit
  3. To calculate the electricity cost of running the recorder
  4. To decide which brand of monitor to buy next year

Explanation

Device identity and firmware determine how footage is stored and exported, and they let a later reviewer reproduce the extraction. Serial numbers also tie the evidence to a specific machine. Cost, staffing, and procurement are unrelated to evidential traceability.

Question 42Video footage retrieval, storage media and chain of custody

A guard hands over a mobile phone containing a video of an incident. What is the most defensible retrieval step?

  1. Extract the file with a forensic tool that logs the process and hash the result Correct answer.
  2. Ask the guard to delete other personal videos first
  3. Forward the video to the auditor's own phone for convenience
  4. Take screenshots of the video playing on the phone

Explanation

Forensic extraction preserves the original file and metadata while creating a documented, hash-verified copy. The log and hash allow later proof that the extracted copy matches the source. Forwarding, deleting, and screenshotting all alter or degrade the evidence.

Question 43Video footage retrieval, storage media and chain of custody

Which record best demonstrates continuity when footage is moved between three officers over two days?

  1. A custody log with a signed entry for each transfer showing time and purpose Correct answer.
  2. A single note at the end summarising that the disk was passed around
  3. An email saying the disk 'should be somewhere in the office'
  4. A verbal confirmation between the officers involved

Explanation

Continuity requires an entry for every transfer, signed by both handing and receiving parties, with time and reason. Gaps of even a few hours must be explainable. Summaries, verbal confirmations, and vague emails leave unaccounted periods.

Question 44Video footage retrieval, storage media and chain of custody

What is the purpose of sealing an evidence bag containing a footage disk with a tamper-evident seal?

  1. To protect the disk from magnetic interference during storage
  2. To improve the read speed of the disk during analysis
  3. To show the item was not accessed without breaking the recorded seal Correct answer.
  4. To comply with the recorder manufacturer's warranty terms

Explanation

A tamper-evident seal, once numbered and recorded, reveals any unauthorised opening. This supports the claim that the item remained as seized until formally opened in a documented session. Magnetic shielding, read speed, and warranties are unrelated purposes.

Question 45Video footage retrieval, storage media and chain of custody

An auditor finds two export files of the same incident with different hash values but identical duration and content on screen. What is the most likely explanation?

  1. The files differ in container, metadata, or encoding despite similar visual content Correct answer.
  2. The DVR clock changed between the two exports
  3. One file must be a forgery and should be discarded immediately
  4. Hashing is unreliable and should be abandoned for video

Explanation

Hashes cover the entire file, so differing containers, metadata, or encoding produce different values even when the visible frames match. The auditor should document both files and their extraction methods. Assuming forgery, abandoning hashing, or blaming the clock is unjustified without further checks.

Question 46Video footage retrieval, storage media and chain of custody

When preparing a footage clip for court presentation, why is a working copy used instead of the sealed original?

  1. To allow the original to be edited later if needed
  2. To reduce the storage space required in the evidence locker
  3. To avoid recording the original in the custody log
  4. To keep the original unaltered for verification while allowing playback Correct answer.

Explanation

The sealed original stays untouched so its hash can be re-verified at any time, while a working copy is used for analysis and playback. This separation protects authenticity. Editing originals, saving locker space, or skipping logs all undermine the process.

Question 47Video footage retrieval, storage media and chain of custody

Which metadata is most useful for proving when a CCTV clip was actually recorded?

  1. The colour of the camera housing
  2. The size of the file in megabytes
  3. The file name chosen by the operator at export
  4. Embedded creation timestamp together with the recorder's time-zone setting Correct answer.

Explanation

Embedded timestamps, read alongside the configured time zone, place the recording on an absolute timeline. This lets the auditor reconcile the clip with independent records. File names are operator-chosen, size is non-temporal, and housing colour is irrelevant.

Question 48Video footage retrieval, storage media and chain of custody

A site uses a network video recorder with remote cloud backup. What custody question must the auditor resolve?

  1. Who controls the cloud account and how access and retention are logged Correct answer.
  2. Whether the cloud provider uses the same camera brands
  3. How much the cloud subscription costs per year
  4. Whether the guards prefer local or remote storage

Explanation

Cloud copies introduce a third party into the custody chain, so account ownership, access logs, retention policy, and export controls must be established. Without this, the provenance of the cloud copy is uncertain. Brand matching, cost, and staff preference do not address custody.

Question 49Video footage retrieval, storage media and chain of custody

During an audit, a DVR is found recording over the exact time window requested. What is the most appropriate professional response?

  1. Ask the DVR to regenerate the deleted video
  2. Reconstruct the missing footage by interviewing witnesses only
  3. Document the overwrite, retention settings, and any partial recovery attempts Correct answer.
  4. State in the report that the footage never existed

Explanation

The auditor must record why the footage is unavailable, including retention configuration and overwrite cycle, and note any forensic recovery attempted. This explains the gap honestly. Witness-only reconstruction, false claims, and impossible regeneration are improper.

Question 50Video footage retrieval, storage media and chain of custody

Which practice most directly protects a footage export from silent corruption on a hard disk?

  1. Verifying the stored hash against the hash recorded at export Correct answer.
  2. Compressing the export repeatedly to save space
  3. Storing the disk next to a strong magnet for safekeeping
  4. Copying the file to the same disk under a new name

Explanation

Recomputing the hash and comparing it with the recorded value detects any bit-level change, whether from media degradation or tampering. This is the standard integrity check. Magnets, repeated compression, and same-disk copies do not detect or prevent corruption.