CAS-001 · Question #158
The VoIP administrator starts receiving reports that users are having problems placing phone calls. The VoIP administrator cannot determine the issue, and asks the security administrator for help…
The correct answer is D. Denial of Service; use rate limiting to limit traffic. SIP (Session Initiation Protocol) INVITE packets are used to initiate VoIP call sessions. Flooding the SIP proxy with excessive INVITE packets overwhelms it, preventing it from processing legitimate call requests - this is a classic Denial of Service (DoS) attack against VoIP…
Question
The VoIP administrator starts receiving reports that users are having problems placing phone calls. The VoIP administrator cannot determine the issue, and asks the security administrator for help. The security administrator reviews the switch interfaces and does not see an excessive amount of network traffic on the voice network. Using a protocol analyzer, the security administrator does see an excessive number of SIP INVITE packets destined for the SIP proxy. Based on the information given, which of the following types of attacks is underway and how can it be remediated?
Options
- AMan in the middle attack; install an IPS in front of SIP proxy.
- BMan in the middle attack; use 802.1x to secure voice VLAN.
- CDenial of Service; switch to more secure H.323 protocol.
- DDenial of Service; use rate limiting to limit traffic.
How the community answered
(38 responses)- A11% (4)
- B29% (11)
- C5% (2)
- D55% (21)
Explanation
SIP (Session Initiation Protocol) INVITE packets are used to initiate VoIP call sessions. Flooding the SIP proxy with excessive INVITE packets overwhelms it, preventing it from processing legitimate call requests - this is a classic Denial of Service (DoS) attack against VoIP infrastructure, specifically SIP flooding or INVITE flooding. The attack is confirmed by the presence of excessive SIP INVITE packets in the protocol analyzer and the absence of excessive bandwidth utilization (ruling out a volumetric network DoS). The appropriate remediation is rate limiting on the SIP proxy or upstream network device to throttle the number of SIP INVITE packets allowed per time interval, blocking the flood while allowing legitimate traffic. Option C is incorrect because switching to H.323 does not inherently protect against DoS attacks. Options A and B (man-in-the-middle) are incorrect because a MitM attack would involve intercepting/altering traffic, not flooding with INVITE packets.
Topics
Community Discussion
No community discussion yet for this question.