SSCA Security in SIP 3 — Questions and Answers
Question 1: SRTP protects which component of a SIP communication session?
- Media streams (RTP) (Correct answer)
- SIP signaling messages
- DNS queries
- SIP header fields only
Correct answer: Media streams (RTP)
SRTP (Secure Real-time Transport Protocol) encrypts and authenticates the media streams (audio/video) carried by RTP, not the SIP signaling.
Question 2: What is 'SIP registration hijacking'?
- An attacker replaces a legitimate user's Contact address in the registrar (Correct answer)
- An attacker floods the registrar with REGISTER requests
- An attacker intercepts TLS certificates
- An attacker spoofs the From header
Correct answer: An attacker replaces a legitimate user's Contact address in the registrar
Registration hijacking occurs when an attacker sends a fraudulent REGISTER request to replace a victim's Contact binding in the registrar, redirecting calls to the attacker.
Question 3: Which SIP security mechanism encrypts the SIP message body (e.g., SDP) end-to-end?
- S/MIME (Correct answer)
- TLS
- SRTP
- Digest Authentication
Correct answer: S/MIME
S/MIME (Secure/Multipurpose Internet Mail Extensions) can encrypt and sign the SIP message body, providing end-to-end content security beyond hop-by-hop TLS.
Question 4: What is toll fraud in the context of SIP telephony?
- Unauthorized use of a SIP system to make expensive calls at the victim's expense (Correct answer)
- Intercepting SIP media streams for eavesdropping
- Sending unsolicited SIP INVITE messages (SPIT)
- Manipulating SIP route headers to reroute calls
Correct answer: Unauthorized use of a SIP system to make expensive calls at the victim's expense
Toll fraud involves attackers compromising a SIP system to place unauthorized international or premium-rate calls, generating charges for the victim.
Question 5: Which SIP header is used by a UAS (not a proxy) to challenge a UAC for authentication credentials?
- WWW-Authenticate (Correct answer)
- Proxy-Authenticate
- Authorization
- Authentication-Info
Correct answer: WWW-Authenticate
A UAS returns a 401 Unauthorized response containing the WWW-Authenticate header to challenge the UAC directly.
Question 6: A Session Border Controller (SBC) primarily helps with SIP security by doing what?
- Acting as a topology-hiding intermediary that controls signaling and media at network borders (Correct answer)
- Encrypting RTP media streams with SRTP
- Providing end-to-end TLS for SIP messages
- Performing Digest authentication on behalf of users
Correct answer: Acting as a topology-hiding intermediary that controls signaling and media at network borders
An SBC sits at network borders, hides internal topology, enforces security policies, and controls both SIP signaling and media flows.
Question 7: What is SPIT in SIP security terminology?
- Spam over Internet Telephony — unsolicited bulk SIP INVITE calls (Correct answer)
- SIP Protocol Integrity Testing
- Secure Private Internet Telephony
- Session Path Interception Technique
Correct answer: Spam over Internet Telephony — unsolicited bulk SIP INVITE calls
SPIT (Spam over Internet Telephony) refers to unsolicited bulk voice calls made using SIP, analogous to email spam.
SSCA Security in SIP 3
SRTP protects which component of a SIP communication session?