The security department will audit an IT department to ensure that the proper guidelines are being followed. The reports of the call detail records show unauthorized access to PSTN. Which two…

Forced Authorization Codes (FAC) or Client Matter Codes (CMC) require users to enter a specific code before completing calls to restricted destinations, such as international numbers or premium rate services, thereby preventing unauthorized PSTN access. This ensures that only authorized personnel can dial out to specific costly or sensitive destinations.

Dropping ad hoc conference calls if an external user is added is a security measure related to conferencing, but it does not directly prevent unauthorized PSTN access for regular outbound calls.

Restricting Call Forward All (CFA) settings and other call forwarding options (Busy/No Answer) to internal extensions prevents an attacker or unauthorized user from forwarding calls to external PSTN numbers, which could be exploited for toll fraud or unauthorized outbound calling. This ensures that internal calls stay within the network unless explicitly allowed by other secure mechanisms.

Restricting logged-out CSS for Extension Mobility primarily impacts what services are available when a phone is not logged in, such as preventing unauthenticated internal calls or restricting emergency calls to specific trunks. While a good security practice, it doesn't directly address preventing unauthorized PSTN access via logged-in users or call forwarding.

Adding an additional firewall between UCM and Expressway-C might enhance network segmentation but does not directly address the logical controls within UCM, like FAC or call forwarding restrictions, that prevent unauthorized PSTN use.