When Cicada is browsing through news articles of Cisco/Vibe, one article that talks about Zoom's army attacking Central City shows an image of Cisco in his Vibe suit, which he didn't use until Season 3's "Dead or Alive".
Caitlin states that the password to her mother's file room was her birthday. However, in the season 3 episode "Monster", Carla didn't appear to remember her daughter's birthday, having sent birthday cards on the incorrect date.
It's unknown how Zoom's suit and Savitar's armor were collected to be shown at the museum, as they were destroyed by Killer Frost and Barry Allen respectively in "Finish Line". Zoom's speed-dampening mask, which was also seen in the museum, had likewise been destroyed by Jay Garrick in "The Race of His Life". Presumably, these artifacts had been replicated for display purposes.