SSCA Security, QoS & Regulatory Compliance 5

Question 1

Which IETF standard defines the use of DTLS (Datagram TLS) for negotiating SRTP keys over the media path?

Accepted Answer

RFC 5764 (DTLS-SRTP)

Answer

RFC 5764 defines DTLS-SRTP, a method that uses a DTLS handshake over the RTP port to establish SRTP keying material without requiring keys in SDP.

Question 2

A VoIP provider is subject to PCI-DSS. Which scenario most directly triggers this compliance requirement?

Accepted Answer

Processing credit card payments over the phone (IVR)

Answer

PCI-DSS applies when cardholder data—including card numbers entered via DTMF in IVR systems—is captured, stored, or transmitted, requiring call recordings and RTP streams to be protected.

Question 3

What is 'toll fraud' in the context of VoIP security?

Accepted Answer

Unauthorized use of a VoIP system to make expensive calls at another party's expense

Answer

Toll fraud (also called IRSF—International Revenue Share Fraud) occurs when attackers compromise a PBX or SIP account and make international or premium calls billed to the victim.

Question 4

Which QoS parameter directly measures the percentage of RTP packets that do not reach the destination?

Accepted Answer

Packet loss

Answer

Packet loss is expressed as a percentage of transmitted RTP packets that are lost in transit; even 1-3% loss can significantly degrade voice quality.

Question 5

Which SIP header field is specifically used to convey the reason a call is being redirected or terminated, commonly used for regulatory logging?

Accepted Answer

Reason header (RFC 3326)

Answer

The Reason header (RFC 3326) carries a cause code (SIP or Q.850) explaining why a request was forwarded or session terminated, supporting CDR and regulatory audit trails.

(SSCA) Sip School Certified Associate Practice Test

(SSCA) Sip School Certified Associate Practice Test

SSCA Security, QoS & Regulatory Compliance 5