Business Phone Systems Security & Compliance 3

Question 1

What is the recommended best practice for securing administrator access to a business VoIP phone system?

Accepted Answer

Enabling multi-factor authentication combined with a strong password policy

Answer

Multi-factor authentication plus strong passwords significantly reduces the risk of unauthorized administrative access, which is especially critical for VoIP systems that can be used for toll fraud.

Question 2

Under GDPR, what must a business do before recording a call with a European customer?

Accepted Answer

Inform the customer about the recording and obtain their consent where required

Answer

GDPR requires transparency about data processing activities, including call recording, and often requires explicit consent since call recordings contain personal data.

Question 3

How are Call Detail Records (CDRs) used for security monitoring on business phone systems?

Accepted Answer

They log call metadata to help detect anomalous patterns that may indicate fraud or unauthorized access

Answer

CDRs capture metadata (caller, recipient, time, duration, cost) for every call, allowing administrators to identify unusual spikes or patterns that may signal toll fraud or a compromised account.

Question 4

Which combination of protocols provides the most complete protection against eavesdropping on VoIP calls?

Accepted Answer

TLS for SIP signaling combined with SRTP for media encryption

Answer

TLS encrypts the SIP signaling that sets up the call, while SRTP encrypts the actual voice media, together providing end-to-end protection against eavesdropping.

Question 5

Which social engineering attack commonly targets business phone systems to gain unauthorized access?

Accepted Answer

Pretexting, where attackers impersonate IT support staff to manipulate employees into revealing credentials

Answer

Pretexting involves an attacker fabricating a convincing scenario — such as posing as IT support — to trick employees into providing login credentials or making unauthorized system changes.

Business Phone Systems Practice Test

Business Phone Systems Practice Test

Business Phone Systems Security & Compliance 3