Business Phone Systems Security & Compliance 2

Question 1

What does PCI DSS require when processing credit card payments over the phone?

Accepted Answer

Cardholder data must be protected and agents must never store CVV codes after authorization

Answer

PCI DSS prohibits storing CVV codes post-authorization and requires phone-based payment environments to implement controls that protect cardholder data throughout the transaction.

Question 2

How do malicious actors use SIP scanning against business phone systems?

Accepted Answer

To discover and exploit vulnerable VoIP devices or servers for toll fraud or eavesdropping

Answer

SIP scanning is a reconnaissance technique where attackers probe networks for exposed VoIP devices with weak credentials or known vulnerabilities that can be exploited.

Question 3

Under US state wiretapping laws, when must businesses inform callers that their call is being recorded?

Accepted Answer

When required by applicable state law, since some states require all-party consent

Answer

Recording disclosure requirements vary by state — two-party (all-party) consent states require informing all participants, so businesses must follow the stricter applicable law.

Question 4

What is the STIR/SHAKEN framework designed to address in the telecom industry?

Accepted Answer

Caller ID spoofing and fraudulent robocalls

Answer

STIR/SHAKEN is a caller authentication framework mandated by the FCC that verifies the caller's identity matches the number displayed, helping combat spoofed robocalls.

Question 5

Which type of denial-of-service attack specifically targets VoIP infrastructure?

Accepted Answer

SIP INVITE flood attack

Answer

A SIP INVITE flood overwhelms a VoIP server with massive numbers of call initiation requests, exhausting resources and disrupting legitimate call processing.

Business Phone Systems Practice Test

Business Phone Systems Practice Test

Business Phone Systems Security & Compliance 2