SSCA Security, QoS & Regulatory Compliance 3 — Questions and Answers
Question 1: Which protocol is used to establish encrypted key exchange for SRTP without embedding keys in SDP?
- SDES
- DTLS-SRTP
- IPsec AH
- ZRTP (Correct answer)
Correct answer: ZRTP
ZRTP (RFC 6189) performs a Diffie-Hellman key agreement in-band within the RTP stream itself, avoiding the need to pass keys through SDP.
Question 2: A VoIP administrator wants to protect SIP signaling in transit between two enterprises. Which combination is most appropriate?
- SIP over TCP with Digest Authentication only
- SIP over TLS (SIPS) with mutual certificate authentication (Correct answer)
- SIP over UDP with SRTP
- SIP over HTTP with OAuth tokens
Correct answer: SIP over TLS (SIPS) with mutual certificate authentication
SIP over TLS (SIPS URI scheme) encrypts signaling in transit, and mutual certificate authentication ensures both endpoints are verified.
Question 3: What is the maximum one-way latency recommended by the ITU-T G.114 standard for acceptable voice quality?
- 50 ms
- 100 ms
- 150 ms (Correct answer)
- 300 ms
Correct answer: 150 ms
ITU-T G.114 recommends a maximum one-way delay of 150 ms for high-quality voice; beyond 400 ms becomes unacceptable for interactive conversation.
Question 4: Which regulatory framework governs the privacy and security of protected health information in US healthcare VoIP deployments?
- PCI-DSS
- SOX
- HIPAA (Correct answer)
- CALEA
Correct answer: HIPAA
HIPAA (Health Insurance Portability and Accountability Act) requires safeguards for protected health information (PHI) including voice communications in healthcare settings.
Question 5: Which SIP security threat involves an attacker intercepting a 200 OK response and replacing the Contact header to redirect future calls to themselves?
- SIP INVITE flooding
- SIP response hijacking (Contact spoofing) (Correct answer)
- Eavesdropping via RTP
- Vishing
Correct answer: SIP response hijacking (Contact spoofing)
Response hijacking occurs when an attacker intercepts a SIP response and modifies the Contact header to redirect subsequent in-dialog requests to an attacker-controlled endpoint.
Question 6: In a DiffServ QoS model, what does the term 'PHB' stand for?
- Physical Header Byte
- Per-Hop Behavior (Correct answer)
- Packet Handling Buffer
- Priority Header Bit
Correct answer: Per-Hop Behavior
PHB stands for Per-Hop Behavior, which defines how a router treats packets of a given DSCP class at each network node.
Question 7: Which SIP mechanism allows a caller to assert their identity on behalf of another user, commonly used in PBX trunking scenarios?
- P-Asserted-Identity (PAI) header (Correct answer)
- From header spoofing
- Contact header rewriting
- Via branch manipulation
Correct answer: P-Asserted-Identity (PAI) header
The P-Asserted-Identity (PAI) header (RFC 3325) allows a trusted network element to assert the true identity of the originating user within a trust domain.
SSCA Security, QoS & Regulatory Compliance 3
Which protocol is used to establish encrypted key exchange for SRTP without embedding keys in SDP?