A security engineer is conducting an audit of an organization's Voice over Internet Protocol (VoIP) phone network due to a large increase in charges from their phone provider. The engineer discovers u

Control eavesdropping involves passively listening to the signaling or control information of a VoIP network, not actively making unauthorized calls to generate charges.

Toll fraud is an attack where unauthorized individuals gain access to a telecommunications system, such as a Voice over Internet Protocol (VoIP) network, to make calls that incur charges to the legitimate account holder. The question explicitly states 'unauthorized endpoints have connected to the phone server... and placed hundreds of unauthorized calls to parties around the globe' leading to 'a large increase in charges,' which precisely defines the act and consequence of toll fraud.

Call hijacking refers to an attacker taking control of an existing, legitimate call between two parties, typically for interception or redirection, rather than initiating new fraudulent calls.

Address spoofing is the act of forging source IP addresses or caller ID information to mask identity or impersonate another entity, but it doesn't describe the broader act of making unauthorized, billable calls.