ALOA Institutional Certified Master Locksmith (ICML)

During a forensic lock examination, fine concentric scratches on the face of a pin tumbler cylinder are most consistent with which entry method?

• ASingle-pin picking with a tension wrench and hook
• BUse of a properly cut operating key
• CDrilling above the shear line
• DBumping with a 999 key

Which forensic finding most strongly indicates that a lock was opened by bumping rather than by picking?

• AImpact marks on the bottom pins and a stressed plug face near the keyway shoulder
• BPolished wear on the master pin
• CSheared driver pin springs
• DCracked plug retainer cap

An institutional locksmith recovers a key left in the door after an intrusion. The first forensic step before any operational testing is to:

• APhotograph and bag the key as evidence with chain of custody documentation
• BDecode the bitting on a key gauge and recut a duplicate
• CInsert it into the lock to confirm operation
• DWipe the key clean for fingerprint testing

A decoded key recovered at a scene measures cuts of 3-5-2-6-4-7 on a standard SC1 keyway. The locksmith confirms it operates the door. Which conclusion is most defensible in court?

• AThe key was cut to match this lock's combination
• BThe key was generated by impressioning
• CThe key is a department-issued master
• DThe key was 3D-printed

Which microscope is most commonly used in forensic locksmithing to compare tool marks on pin tumblers?

• AComparison microscope
• BPolarizing light microscope
• CFluorescence microscope
• DConfocal scanning microscope

When documenting an impressioned key as evidence, the most diagnostic feature is:

• ATriangular file marks angled across each cut
• BPolished bow
• CWorn shoulder
• DOriginal factory stamping

A pin tumbler cylinder shows a clean cut through the plug at the shear line. The most likely entry method is:

• ADrilling at the shear line
• BBumping
• CSingle-pin picking
• DDecoder use

Which item should NOT appear in a forensic locksmith's evidence kit?

• AStandard pick set used for operational lockouts
• BTamper-evident evidence bags
• CCaliper or pin micrometer
• DComparison-grade reference key set

In a forensic report, the phrase 'within a reasonable degree of locksmithing certainty' indicates:

• AThe examiner's professional opinion based on training and the physical evidence
• BA statistical probability above 95%
• CAbsolute proof
• DA guess

Crescent-shaped marks at the rear of the keyway on the plug face are most consistent with:

• AUse of a tension wrench during picking
• BRoutine key insertion
• CLubricant flushing
• DCylinder freezing damage

Which is the correct order of forensic processing on a recovered cylinder?

• APhotograph, document, transport intact, then disassemble in the lab
• BDisassemble at the scene, then photograph the components
• CTest operation, then disassemble, then photograph
• DMark the plug with a punch before photographing

A high-security cylinder shows a hardened drill bit fragment embedded in the face. The forensic significance is that:

• AThe hardened anti-drill insert performed its intended function and resisted the attack
• BThe cylinder was defective
• CThe drill bit was poor quality
• DThe plug was bypassed without drilling

The most defensible way to label evidence cylinders in a multi-door incident is to:

• AUse unique evidence numbers tied to a scene diagram
• BMark each plug with a punch
• CUse the room number written on tape
• DTrust the responding officer's memory

When examining a cylinder for evidence of bumping, the examiner should pay particular attention to:

• ADriver pin tips, plug face shoulder area, and spring deformation
• BKey bow stamping
• CCam screw threads
• DStrike plate alignment

In a multi-building campus master key system, which level traditionally operates every cylinder in the system?

• AGreat Grand Master (GGM)
• BGrand Master (GM)
• CMaster (MK)
• DChange key (CK)

In Total Position Progression (TPP), what is the maximum theoretical number of usable change keys in a six-pin system with two-step progression and ten depths?

• A15,625
• B10,000
• C5,040
• D117,649

A cross-keyed cylinder is one that:

• AIs intentionally operated by more than one key from different levels of the system
• BHas been picked
• COperates with a bump key only
• DCannot be operated by the master

Small Format Interchangeable Core (SFIC) cylinders differ from Large Format Interchangeable Core (LFIC) primarily in:

• ABody size and the figure-8 core profile of SFIC
• BPin count
• CMaster key compatibility
• DWhether they can be rekeyed

In an SFIC system, the control key:

• AOperates the control shear line to remove the core from the housing
• BIs the same as the great grand master
• CCuts the construction master
• DReplaces the change key

Which is a primary disadvantage of expanding an existing master key system without re-engineering it?

• AAccumulating key interchange (unintended cross-keying)
• BImproved security
• CLower hardware cost
• DFaster rekeys

Software-based key management platforms (e.g., InstaCode/CodeSource, AlmaPlus) primarily add value by:

• ATracking key issuance, returns, and audit trails for each cardholder
• BCutting keys mechanically
• CReplacing physical cylinders
• DBypassing pin tumbler design

In selective master keying:

• ASpecific change keys operate specific groups of locks outside the normal master hierarchy
• BAll change keys operate every lock
• CThe grand master is removed
• DOnly the great grand master is used

MACS (Maximum Adjacent Cut Specification) is critical because:

• AExceeding it prevents the key from being cut or inserted without binding
• BIt defines the master key
• CIt sets the spring tension
• DIt is the same as the depth code

A multi-building campus needs key control for 6,000 cylinders. The best design choice for long-term auditability is:

• ARestricted/patented keyway with software key management and SFIC cores
• BStandard Kwikset KW1 keyway with paper logs
• CConventional Schlage SC1 with stamped keys
• DPadlocks only

Construction master keying is typically removed by:

• AInserting and turning the construction-breakout key, which ejects breakout wafers
• BDrilling the cylinder
• CReplacing the entire lockset
• DCutting a new master key

In hierarchical master keying, which is the most security-sensitive level to control?

• AThe top-level master (GGM or GM)
• BIndividual change keys
• CConstruction master
• DVisitor key

An institutional master key chart's 'page' typically represents:

• AA group of cylinders sharing a sub-master under the same branch of the hierarchy
• BA single building
• COne change key
• DAn elevator key

The recommended industry practice when a top-level master key is lost in an institutional system is to:

• ARekey or rotate every cylinder beneath that master per a documented key control policy
• BIssue a memo telling staff to be careful
• CWait until the next budget cycle
• DIgnore the loss because the key is restricted

Medeco Classic cylinders gain pick resistance primarily from:

• AAngled and rotating bottom pins requiring correct lift and rotation
• BHeavier driver springs
• CMagnetic pins
• DPlastic pin chambers

Mul-T-Lock cylinders are characterized by:

• ATelescoping pin-in-pin design with internal and external pins
• BDisc detainers only
• CMagnetic ball-bearing pins
• DLever tumblers

Abloy Protec2 cylinders use which fundamental locking mechanism?

• ARotating disc detainers and a sidebar
• BStandard pin tumblers
• CWafer tumblers
• DMagnetic dimples only

Sargent Signature (XC) cylinders add security primarily by:

• AA side-cut undercut and active sidebar in addition to the standard top-cut pins
• BRemoving the standard shear line
• CMagnetic encoding
• DRFID chips inside the key

UL 437 listed cylinders are tested against drilling, picking, and:

• AForced impact and key impressioning attacks
• BFire only
• CRadio frequency interference
• DMagnetic fields

ANSI/BHMA A156.2 Grade 1 cylindrical locks must withstand a minimum of:

• AApproximately 800,000 operational cycles in testing
• B100,000 cycles
• C10 million cycles
• DNo cycle test

Geometric pin systems (e.g., chisel-tipped pins) differ from standard pin tumblers because they:

• ARequire the key cut to be both at the correct depth AND angle
• BAre made of plastic
• CReplace the keyway
• DEliminate the shear line

Restricted keyways add a layer of security primarily by:

• ALegally and physically limiting who can obtain or duplicate blanks
• BIncreasing the number of pins
• CAdding magnetic fields
• DReplacing the cylinder body

A key carries patent protection for approximately how long, after which the design enters the public domain?

• A20 years from filing for utility patents
• B5 years
• CForever
• D10 years

When specifying high-security cylinders for an institutional retrofit, the most important first compatibility check is:

• AMortise/rim/key-in-knob form factor and cam compatibility with existing hardware
• BColor of the key bow
• CManufacturer logo placement
• DWhether the key is brass or nickel-silver

Medeco M3 added which feature beyond Medeco Classic?

• AA slider element on the key requiring lateral movement of an internal blocking element
• BMagnetic pins
• CRFID
• DA second cam

ASSA Twin 6000 series cylinders use which dual-locking mechanism?

• ATwo independent pin stacks (top and side) each with its own shear line
• BPins and disc detainers
• CLever tumblers only
• DMagnetic and pin

OSDP (Open Supervised Device Protocol) is preferred over Wiegand in modern institutional access control primarily because:

• AIt provides encrypted, bidirectional, supervised communication between reader and control…
• BIt uses fewer wires
• CIt is faster only
• DIt is older and more familiar

Mobile credentials transmitted via Bluetooth Low Energy (BLE) typically authenticate using:

• APublic-key cryptography with a credential bound to the device's secure element
• BPlaintext device IDs
• CWiegand 26-bit
• DMagnetic stripe

Biometric readers in institutional access typically operate as which factor of authentication?

• ASomething you ARE
• BSomething you HAVE
• CSomething you KNOW
• DSomething you DO

An IP-based access control panel that loses connection to its head-end server should:

• AContinue to make local access decisions from its cached database (edge decision-making)
• BLock all doors permanently
• CUnlock all doors permanently
• DStop functioning

Integration between access control and a Building Automation System (BAS) most often uses which messaging standard?

• ABACnet/IP or BACnet over MS/TP for HVAC and lighting interoperability
• BWiegand 26-bit
• CRS-232 only
• DAnalog 4-20 mA

An institutional reader provisioned with the SEOS or DESFire EV2/EV3 credential profile improves on legacy 125 kHz prox cards by:

• AUsing mutual authentication and AES encryption between card and reader
• BOperating at longer ranges
• CEliminating the need for a controller
• DRemoving the need for cardholder records

Anti-passback is an access control feature that prevents:

• AA credential from being used to enter again before it has been used to exit
• BTailgating
• CUse of expired credentials
• DDuress codes

Two-factor authentication at an access-controlled door is achieved by combining:

• AA credential (something you have) with a PIN or biometric (something you know or are)
• BTwo cards from the same person
• CTwo readers stacked vertically
• DA push-button request-to-exit and a card