ACA Security & Authentication in VoIP 1 — Questions and Answers
Question 1: Which transport protocol does TLS (Transport Layer Security) replace in SIP to provide encrypted signaling?
- UDP and TCP (TLS runs over TCP providing encryption) (Correct answer)
- UDP only
- SCTP
- IPsec
Correct answer: UDP and TCP (TLS runs over TCP providing encryption)
TLS runs over TCP and provides encryption, authentication, and integrity for SIP signaling, replacing unencrypted TCP (and effectively UDP where TLS/TCP is used instead).
Question 2: In AudioCodes Mediant TLS configuration, what is the role of the 'TLS Context'?
- It groups TLS certificates, keys, and cipher suites applied to SIP interfaces or SBC legs (Correct answer)
- It defines the UDP fallback timeout when TLS fails
- It specifies the TLS version used for HTTPS management only
- It manages the SRTP key exchange method
Correct answer: It groups TLS certificates, keys, and cipher suites applied to SIP interfaces or SBC legs
A TLS Context bundles the certificate chain, private key, trusted CA certificates, and cipher suite preferences applied to one or more SIP interfaces for mutual TLS.
Question 3: What attack does 'SIP Digest Authentication' (using 401/407 challenges) protect against in VoIP environments?
- Unauthorized call origination by requiring valid credentials before processing INVITE or REGISTER requests (Correct answer)
- Eavesdropping on RTP media streams
- BGP route hijacking of SIP trunks
- DNS poisoning of SIP proxy records
Correct answer: Unauthorized call origination by requiring valid credentials before processing INVITE or REGISTER requests
SIP Digest Authentication uses a challenge-response mechanism (MD5/SHA hash of credentials) to verify that the calling entity is authorized before allowing call setup or registration.
Question 4: Which AudioCodes SBC security feature rate-limits SIP messages to protect against DoS and flooding attacks?
- SIP Message Policy (SIP Whitelist/Blacklist and rate limiting) (Correct answer)
- SNMP ACL
- Firewall Rule Sets
- IP Group Bandwidth Limit
Correct answer: SIP Message Policy (SIP Whitelist/Blacklist and rate limiting)
AudioCodes SBC includes SIP message classification and rate-limiting policies that block or throttle excessive SIP messages from unknown or suspicious sources, mitigating DoS attacks.
Question 5: What is 'SPIT' (Spam over Internet Telephony) and which AudioCodes feature helps mitigate it?
- Unsolicited bulk VoIP calls; mitigated via SIP blacklists, CAPTCHA challenges, and call rate limiting (Correct answer)
- A type of RTP injection attack; mitigated with SRTP
- A SIP header spoofing technique; mitigated with TLS
- A codec negotiation exploit; mitigated with SDP filtering
Correct answer: Unsolicited bulk VoIP calls; mitigated via SIP blacklists, CAPTCHA challenges, and call rate limiting
SPIT refers to automated spam calls over VoIP; AudioCodes SBC counters it using SIP source blacklisting, registration rate limiting, and anomaly detection policies.
Question 6: In AudioCodes Mediant, which feature detects and blocks SIP INVITE flood attacks in real time?
- Intrusion Detection System (IDS) / SIP Robustness (Correct answer)
- QoS Policing
- RTCP-based Anomaly Detection
- SIP Session Border Policy
Correct answer: Intrusion Detection System (IDS) / SIP Robustness
AudioCodes' built-in IDS monitors SIP INVITE rates per source and blocks sources exceeding configured thresholds, protecting the device from volumetric SIP flood attacks.
ACA Security & Authentication in VoIP 1
Which transport protocol does TLS (Transport Layer Security) replace in SIP to provide encrypted signaling?