Business Phone Systems Security & Compliance 2 — Questions and Answers
Question 1: What does PCI DSS require when processing credit card payments over the phone?
- All payment calls must be free of charge to the customer
- Cardholder data must be protected and agents must never store CVV codes after authorization (Correct answer)
- Phone payment calls must be completed in under 5 minutes
- Customers must verify their card in person before phone payments are accepted
Correct answer: Cardholder data must be protected and agents must never store CVV codes after authorization
PCI DSS prohibits storing CVV codes post-authorization and requires phone-based payment environments to implement controls that protect cardholder data throughout the transaction.
Question 2: How do malicious actors use SIP scanning against business phone systems?
- To improve call routing efficiency across providers
- To discover and exploit vulnerable VoIP devices or servers for toll fraud or eavesdropping (Correct answer)
- To monitor employee call volume and productivity
- To optimize bandwidth allocation for voice traffic
Correct answer: To discover and exploit vulnerable VoIP devices or servers for toll fraud or eavesdropping
SIP scanning is a reconnaissance technique where attackers probe networks for exposed VoIP devices with weak credentials or known vulnerabilities that can be exploited.
Question 3: Under US state wiretapping laws, when must businesses inform callers that their call is being recorded?
- Only when recording calls for quality assurance training
- When required by applicable state law, since some states require all-party consent (Correct answer)
- Only for calls lasting more than 10 minutes
- Only for outbound sales calls
Correct answer: When required by applicable state law, since some states require all-party consent
Recording disclosure requirements vary by state — two-party (all-party) consent states require informing all participants, so businesses must follow the stricter applicable law.
Question 4: What is the STIR/SHAKEN framework designed to address in the telecom industry?
- High international call routing costs
- Caller ID spoofing and fraudulent robocalls (Correct answer)
- Poor call audio quality on VoIP networks
- International number portability issues
Correct answer: Caller ID spoofing and fraudulent robocalls
STIR/SHAKEN is a caller authentication framework mandated by the FCC that verifies the caller's identity matches the number displayed, helping combat spoofed robocalls.
Question 5: Which type of denial-of-service attack specifically targets VoIP infrastructure?
- SQL injection attack
- SIP INVITE flood attack (Correct answer)
- Cross-site scripting attack
- Man-in-the-browser attack
Correct answer: SIP INVITE flood attack
A SIP INVITE flood overwhelms a VoIP server with massive numbers of call initiation requests, exhausting resources and disrupting legitimate call processing.
Question 6: Which security measure helps ensure only authorized devices can register on a business VoIP phone system?
- Reducing the maximum number of simultaneous calls
- MAC address filtering or SIP digest authentication for device registration (Correct answer)
- Increasing available bandwidth for voice traffic
- Disabling call forwarding on all extensions
Correct answer: MAC address filtering or SIP digest authentication for device registration
MAC address filtering or SIP digest authentication verifies device identity before allowing registration, preventing unauthorized phones from connecting to the phone system.
Question 7: What does E-911 compliance require of business VoIP phone systems?
- All calls must be routed through the local PSTN provider
- The system must transmit accurate physical location data with every emergency call (Correct answer)
- Emergency calls must be answered within 3 rings
- All employees must complete annual emergency response training
Correct answer: The system must transmit accurate physical location data with every emergency call
E-911 compliance requires that when any user dials 911, the phone system automatically provides emergency services with the caller's accurate physical location.
Business Phone Systems Security & Compliance 2
What does PCI DSS require when processing credit card payments over the phone?