ACA Security & Authentication in VoIP 2 — Questions and Answers
Question 1: What is 'SIP Topology Hiding' on an AudioCodes SBC designed to protect?
- Internal network topology and private IP addresses by replacing them in SIP headers before forwarding to external networks (Correct answer)
- The SRTP encryption keys from interception
- The PSTN gateway identities from SIP providers
- The codec list from competitor analysis
Correct answer: Internal network topology and private IP addresses by replacing them in SIP headers before forwarding to external networks
Topology Hiding replaces internal hostnames, private IP addresses, and sensitive header values in SIP messages, preventing external parties from learning internal network details.
Question 2: Which SIP header is most commonly manipulated by AudioCodes for topology hiding on outbound calls?
- Via
- Contact
- From
- All of the above (Correct answer)
Correct answer: All of the above
Topology hiding typically modifies the Via, Contact, Record-Route, and From headers to replace internal IPs with the SBC's public-facing address.
Question 3: What does 'SRTP with SDES key exchange' mean in an AudioCodes SBC context?
- SRTP encryption keys are exchanged in-band within the SDP offer/answer, relying on SIP TLS for key security (Correct answer)
- Keys are exchanged using DTLS before media starts
- Keys are derived from a pre-shared password
- Keys are negotiated via MIKEY protocol
Correct answer: SRTP encryption keys are exchanged in-band within the SDP offer/answer, relying on SIP TLS for key security
SDES (Session Description Protocol Security Descriptions) embeds SRTP key material directly in SDP, making TLS mandatory for the SIP signaling to protect those keys.
Question 4: In AudioCodes access control, what is the function of an 'IP Address Allow/Deny List'?
- To permit or block SIP and management traffic from specific IP addresses or subnets (Correct answer)
- To define which codecs are allowed per IP group
- To restrict which SIP methods are permitted
- To control VLAN access on physical ports
Correct answer: To permit or block SIP and management traffic from specific IP addresses or subnets
IP Allow/Deny Lists filter incoming connections at the IP layer, permitting traffic only from known trusted addresses and blocking all others, providing a first line of defense.
Question 5: Which certificate type does AudioCodes recommend for production TLS SIP trunks to ensure interoperability and trust?
- CA-signed certificates from a trusted public Certificate Authority (Correct answer)
- Self-signed certificates generated on the device
- Password-protected PEM certificates
- Wildcard certificates for all subdomains
Correct answer: CA-signed certificates from a trusted public Certificate Authority
CA-signed certificates from recognized public CAs ensure that remote SIP peers can verify the device's identity without needing to manually install the certificate, improving interoperability.
Question 6: What is the purpose of 'Media Anchoring' (media pinning) on an AudioCodes SBC from a security perspective?
- It forces all RTP media to flow through the SBC rather than being routed directly between endpoints, enabling monitoring and policy enforcement (Correct answer)
- It pins SRTP keys to prevent renegotiation
- It anchors the SIP dialog to a specific signaling interface
- It prevents media codec renegotiation mid-call
Correct answer: It forces all RTP media to flow through the SBC rather than being routed directly between endpoints, enabling monitoring and policy enforcement
Media anchoring ensures RTP streams pass through the SBC, allowing it to apply security policies, QoS marking, recording, and topology hiding on media traffic.
ACA Security & Authentication in VoIP 2
What is 'SIP Topology Hiding' on an AudioCodes SBC designed to protect?