CAS-002 · Question #138
The VoIP administrator starts receiving reports that users are having problems placing phone calls. The VoIP administrator cannot determine the issue, and asks the security administrator for help…
The correct answer is D. Denial of Service; use rate limiting to limit traffic. An excessive flood of SIP INVITE packets targeting the SIP proxy is a Denial of Service attack against the VoIP infrastructure, best mitigated by applying rate limiting to the affected traffic.
Question
The VoIP administrator starts receiving reports that users are having problems placing phone calls. The VoIP administrator cannot determine the issue, and asks the security administrator for help. The security administrator reviews the switch interfaces and does not see an excessive amount of network traffic on the voice network. Using a protocol analyzer, the security administrator does see an excessive number of SIP INVITE packets destined for the SIP proxy. Based on the information given, which of the following types of attacks is underway and how can it be remediated?
Options
- AMan in the middle attack; install an IPS in front of SIP proxy.
- BMan in the middle attack; use 802.1x to secure voice VLAN.
- CDenial of Service; switch to more secure H.323 protocol.
- DDenial of Service; use rate limiting to limit traffic.
How the community answered
(34 responses)- A6% (2)
- B12% (4)
- C15% (5)
- D68% (23)
Why each option
An excessive flood of SIP INVITE packets targeting the SIP proxy is a Denial of Service attack against the VoIP infrastructure, best mitigated by applying rate limiting to the affected traffic.
A Man-in-the-Middle attack requires intercepting communications between two parties; flooding a single target with unsolicited INVITE packets matches the DoS pattern, not interception, and an IPS placement would not address the volumetric nature of the flood.
802.1x provides port-based network access control for authentication but cannot stop a flood of SIP INVITE packets originating from an already-authenticated device on the voice VLAN.
H.323 is an older VoIP signaling protocol that is equally susceptible to connection-flooding attacks; switching protocols does not address the underlying DoS vector.
Flooding a SIP proxy with INVITE packets overwhelms its call-processing capacity, preventing legitimate call setup requests from completing - a classic application-layer DoS attack pattern. Rate limiting restricts the number of INVITE requests processed per second from any given source, throttling attack traffic and restoring normal call handling without requiring a protocol change or replacement.
Concept tested: SIP INVITE flood DoS attack identification and rate limiting remediation
Source: https://csrc.nist.gov/publications/detail/sp/800-58/final
Topics
Community Discussion
No community discussion yet for this question.