ALOA Certified Automotive Locksmith (CAL)

Which lock type is most commonly found on older GM vehicles (pre-2000) using the 'B' or 'D' keyway?

• ADimple lock
• BWafer tumbler lock
• CTibbe lock
• DRotating disc detainer lock

Ford's Tibbe lock (used on Jaguar and older Ford Europe models) is best described as what type of mechanism?

• APin tumbler with sidebar
• BRotating disc with axial cuts on a round key blade
• CFlat wafer with sidebar
• DDimple lock with drilled pin dimples

High-security 'sidewinder' (laser-cut) keys use cuts milled where on the blade?

• AOnly on the tip of the blade
• BA serpentine track milled down the center or face of the blade
• COnly dimples drilled into the bow
• DCuts on the top edge of a traditional blade

The Mercedes-Benz HU64 high-security lock operates using what internal mechanism?

• APin tumblers stacked vertically
• BRotating disc detainers with a sidebar
• CTwo independent sliders (upper and lower) read by a milled track
• DFour wafers and a spool driver

A 'dimple' style automotive lock is characterized by:

• AWafers that protrude from a flat plug
• BDrilled dimples (pockets) on the flat of the key face read by pins that move perpendicula…
• CAxial cuts that rotate discs
• DA serpentine track milled down the center

Which Chrysler keyway family is associated with post-1998 vehicles using an 8-cut high-security blade?

• AY157
• BY159/Y160 (SIP22)
• CB91
• DH75

Ford 10-cut wafer locks (H75/1196FD) are typically found on which vehicles?

• A1990s–early 2000s Ford cars and light trucks before the HU101 transition
• BOnly 2015+ Mustangs
• COnly European Ford Fiesta and Focus
• DOnly Lincoln Town Car with Tibbe

The HU101 keyway is associated primarily with which manufacturer?

• AChrysler
• BFord (post-2011 high-security sidewinder)
• CMercedes
• DToyota

Which keyway is standard for the VW/Audi Group high-security laser-cut key?

• AHU92
• BHU66
• CHU64
• DTOY48

Rotating disc detainer cylinders (Abloy-style) appear on which common automotive application?

• AMost GM ignition cylinders
• BSome Mercedes and Volvo steering/ignition locks, especially older European models
• CAll Toyota smart systems
• DOnly motorcycle locks

A 'transponder key' differs from a plain metal key because it contains:

• AA miniature remote transmitter that sends a rolling code on a button press
• BA passive RFID chip in the bow that the immobilizer reads when the key is in the ignition
• CA GPS tracker
• DA magnetic strip like a credit card

A 'remote head key' (RHK) is best defined as:

• AA key blade and a separate fob
• BA single unit where the key blade and RKE remote are integrated into one bow
• CA proximity smart key with no blade
• DA valet-only key

A smart proximity key (PEPS) differs from an RHK primarily because:

• AIt still requires insertion into the ignition to start
• BIt uses only a mechanical blade
• CIt communicates passively over LF/UHF so the car detects presence for keyless entry and p…
• DIt contains no battery

A 'valet key' typically:

• AOperates the ignition and doors but not the trunk or glove box lock (often with separate…
• BOpens only the trunk
• CWorks everything except the ignition
• DIs always non-transponder

A 'flip key' (switchblade key) is:

• AA key that splits into two halves
• BA remote head design where the blade folds into the bow via a spring-loaded button, simil…
• CA blade with two bittings opposite each other
• DAnother name for a laser-cut key

The original Philips PCF7930/PCF7931 transponder used what authentication type?

• ADynamic rolling code with AES
• BFixed-code, read/write — an early non-encrypted Gen 1/2 transponder
• CDST80 challenge-response
• DHitag 3 bidirectional

The PCF7935 (Megamos Crypto precursor, often called 'ID44') is notable because:

• AIt is a fixed, writable chip used in many 1990s European immobilizers (BMW, Mercedes, Vol…
• BIt is the first DST80 chip
• CIt is a passive GPS device
• DIt is exclusive to Toyota G-chip

The PCF7936 (ID46) chip is distinctive because:

• AIt is a Hitag 2 cryptographic transponder used widely on GM, Chrysler, Renault, Peugeot,…
• BIt is the same as an ID48
• CIt has no cryptography
• DIt only works at 13.56 MHz

The Texas Instruments DST40 transponder (e.g., original Toyota 4C/4D, early Ford 8C/8D) is associated with what vulnerability disclosed by academic researchers?

• AIt is completely unbreakable
• BThe 40-bit proprietary cipher was reverse-engineered and shown to be recoverable in minut…
• CIt uses AES-256
• DIt was physically destroyed by sunlight

The Toyota 'G' chip (4D-72) is notable because:

• AIt can be duplicated by any cloner
• BAll-keys-lost requires smart key reset, not cutting from VIN; most scenarios need OBD pro…
• CIt is always precodable
• DIt has no encryption

The Megamos Crypto (ID48) transponder is used predominantly by:

• AChrysler from 2015+
• BThe VW/Audi/Seat/Skoda group (immo 2/3/4), Porsche, and some Honda/Fiat applications
• CFord F-series post-2017
• DOnly motorcycles

Hitag 2 operating at 125 kHz uses a key length of:

• A128 bits
• B48 bits
• C64 bits (32-bit transport/48-bit implementation, commonly described as 48-bit symmetric c…
• D256 bits

Which transponder family is used by BMW CAS3+/CAS4 vehicles (~2008–2016)?

• AID46 (PCF7936)
• BPCF7945 (Hitag Pro, 'ID49-like') for CAS4; PCF7942/7944 for CAS3+
• CDST40 only
• DTibbe mechanical only

The Toyota 'H' chip introduced around 2013 replaced the G chip to address what threat?

• ALow-frequency relay attacks
• BDST80 cryptanalysis — 'H' uses AES-128 bidirectional authentication, resisting the academ…
• CBattery drain
• DPhysical wear

GM PassKey I (VATS) used what technology?

• AA passive RFID chip
• BA resistor pellet embedded in the key blade that must match one of 15 resistance values
• CAn AES-encrypted rolling code
• DA rotating disc reader

GM PK3 (PassKey III) uses which transponder family?

• AResistor pellet
• BTexas Instruments DST40 (Circle+ / Circle-plus-plus) — some later PK3+ moved to ID46 Hita…
• CMegamos only
• DMercedes infrared only

Ford PATS (Passive Anti-Theft System) went through what chip/transponder evolution?

• AOnly used 4D63
• BGen 1 TI 4C → Gen 2 TI 4D60 (8C/D, 40-bit) → Gen 4 4D63 80-bit → Gen 5 HITAG Pro/AES on p…
• CNever used transponders
• DOnly Megamos

Chrysler SKIM/SKIS (Sentry Key Immobilizer Module/System) uses what chip family?

• A4D64 DST40 through mid-2000s then ID46 (PCF7936) on most vehicles 2006+; WIN module on LX…
• BOnly Hitag 3
• COnly Megamos
• DResistor pellet

BMW E46/E39/early E90 vehicles with EWS3/EWS4 immobilizers are programmed how?

• AOn-board 10-minute timer
• BReading EWS EEPROM (bench), locating a free key slot, writing the new key's ISN/EWS data,…
• CSimply inserting any PCF7936
• DCutting the key alone is sufficient

Mercedes-Benz DAS (Drive Authorization System) / EZS / EIS — what does 'EIS' refer to?

• AElectronic immobilizer only
• BElectronic Ignition Switch — the module that houses the key slot and stores SKC/VIN; it i…
• CExterior illumination sensor
• DEngine intake system

VAG (VW/Audi/Seat/Skoda) immobilizer generation that introduced the component protection (component-to-VIN binding) is:

• AImmo 1
• BImmo 3 (and expanded in Immo 4/5/MQB)
• CImmo 0
• DTibbe

Honda immobilizer on most 1998–2013 vehicles uses which chip?

• AID48 only
• BMegamos 13 (ID13) early, then Philips 46/47 (ID46, ID47) on later vehicles
• COnly DST40
• DNo transponder

Nissan NATS (Nissan Anti-Theft System) generation that introduced BCM-based programming with a 20-digit PIN code is:

• ANATS 1
• BNATS 5/BCM (later Nissan Connect I-key)
• CNATS 2
• DNone — Nissan never used PINs

BMW FEM/BDC (F-series, 2014+) replaces CAS; adding a key typically requires:

• ASimple on-board procedure
• BPre-coding FEM/BDC via bench (reading/writing ISN, unlocking, disabling key positions) wi…
• CResistor pellet
• DUsing a Tibbe pick

Hyundai/Kia Smart Key systems (2012+) are typically distinguished by:

• AAll using Tibbe
• BUsing a 4-byte or 6-byte PIN code for programming and a mix of Hitag 2, ID46, and later H…
• COnly resistor pellets
• DNo immobilizer at all

Subaru immobilizers 2003–2015 mostly use what transponder?

• AID46 only
• BTexas Instruments 4D62/4D65 DST40/80 variants, keyed through dealer SSM or Autel/SmartPro
• CMegamos only
• DResistor pellet

Mazda 2006–2013 immobilizers (non-smart-key) commonly use:

• A4D63 Ford PATS-family chip (40-bit and 80-bit variants) on vehicles sharing Ford architec…
• BTibbe only
• CResistor pellets
• DNo chip

A 'VIN-to-key-code' lookup returns:

• AThe PIN for the immobilizer directly
• BThe mechanical bitting code needed to cut a key to that vehicle's factory specification
• CThe radio station presets
• DThe engine serial number

NASTF stands for:

• ANational Automotive Service Task Force
• BNorth American Security Technicians Federation
• CNational Anti-Skid Theft Force
• DNew American Standard Transponder Format

To register with NASTF as a Vehicle Security Professional (VSP) a locksmith must typically:

• AOnly pay a fee
• BPass a background check, be bonded/insured with specified liability coverage, provide sta…
• CHold a doctorate
• DWork only for dealers

The Secure Data Release Model (SDRM) is primarily used to:

• AUnlock internet accounts
• BRequest anti-theft key codes and immobilizer PINs directly from OEM portals with audit lo…
• CTransfer ownership titles
• DReset airbag modules

Before releasing a key code or generating a key for a customer's vehicle the locksmith must verify:

• AOnly the customer's phone number
• BGovernment-issued ID matching the customer AND proof of ownership (title, registration, o…
• COnly the VIN
• DNothing — key service is unregulated

A 'pin code' (in the transponder programming context) typically refers to:

• AA 4-pin connector layout
• BThe immobilizer security/SKC code required by the programming tool to enable key learning…
• CAn 8-pin tumbler stack
• DA punch pin

A Lishi 2-in-1 tool is designed for:

• ACutting only
• BPicking AND decoding an automotive cylinder simultaneously, then reading out the bitting…
• COnly decoding — cannot pick
• DRemote reflashing

Impressioning an automotive wafer lock involves:

• ADrilling out each wafer
• BInserting a blank, rotating under tension, and filing at marks left by binding wafers unt…
• CHeating the blank to mold it
• DPhotographing the keyway

Removing a GM 10-cut ignition cylinder when picking fails usually requires:

• ACutting the entire dashboard
• BDrilling the shear line, breaking the lock-cylinder retainer, or using a dedicated cylind…
• CNo removal is ever possible
• DRemoving the entire steering column

A 'plug spinner' in automotive work is:

• AA tool that quickly rotates a picked plug past its resting position to the open position,…
• BA key duplicator
• CA transponder programmer
• DA tire balancing device

When decoding a door lock as a 'progression path' for the ignition, the locksmith should be aware that:

• ADoors always match the ignition 100%
• BDoor locks may have a shorter wafer stack (fewer cuts) than the ignition — progression fr…
• CDoors are always different
• DOnly the trunk matters