In this simulation, you will analyze network infrastructure components associated with modern unified communications. You will learn to identify core protocols that encapsulate voice traffic and understand the defensive posture required to secure them.

CND (312-38) Network Defense Simulation

Network Scenario

Your organization is migrating from a legacy Public Switched Telephone Network (PSTN) and internal PBX infrastructure to a modern internet-based unified communications platform. This transition is intended to reduce long-distance costs and integrate seamlessly with remote worker VPN profiles.

As the Network Security Analyst, you are configuring the edge firewall and internal QoS policies to prioritize and secure this new voice traffic. The architecture requires you to permit specific signaling (TCP/UDP 5060) and media transport (UDP 10000-20000) channels while inspecting for toll fraud attempts and SIP brute-forcing.

Traffic & Logs

[FIREWALL] RULE_ADD: Permit Inbound IP WAN_INT to VLAN_VOICE PROTOCOL: UDP DPORT: 5060 ACTION: ALLOW DESC: "Voice Signaling" PROTOCOL: UDP DPORT: 10000-20000 ACTION: ALLOW DESC: "Media Streams" [QoS] POLICY_UPDATE: Tag DSCP EF (Expedited Forwarding) for Voice Media [IDS/IPS] ALERT ENABLED: SID 2011716 - ET VOIP Multiple Unauthorized SIP Responses

Question

Fill in the blank with the appropriate term. The ____________ is used for routing voice conversations over the Internet. It is also known by other names such as IP Telephony, Broadband Telephony, etc.

Hint: Look at the acronyms. You are replacing legacy phone lines with an architecture that transmits Voice over an Internet Protocol network.

Expert Analysis

1. What is happening in the network

The network is undergoing a foundational architectural shift, moving real-time voice communications from isolated analog circuits to the standard IP data network. Firewall policies and QoS (Quality of Service) configurations are being adjusted to handle latency-sensitive UDP traffic streams.

2. Identify attack or behavior

Deploying this technology introduces new threat vectors to the IP network. Defenders must monitor for SIP enumeration (attackers scanning for active extensions), toll fraud (unauthorized long-distance routing), Vishing, and packet sniffing (eavesdropping on unencrypted UDP media streams).

3. Why correct answer is correct

VoIP (Voice over IP) is the correct overarching term for technologies that deliver voice communications and multimedia sessions over IP networks. It encompasses the entirety of "IP Telephony" and "Broadband Telephony."

4. Why others are wrong

PSTN: Public Switched Telephone Network is the legacy analog network being replaced, not the internet-based routing mechanism.
PBX: Private Branch Exchange is the internal telephone switching system (which can be traditional or IP-based), but it is a device/system, not the technology for routing voice over the internet.
SMTP: Simple Mail Transfer Protocol is used for email routing, not real-time voice conversations.

5. Defensive action

To secure VoIP implementations, network defenders must segment voice traffic into a dedicated Voice VLAN. Furthermore, signaling should be encrypted using SIP over TLS, and media streams should be encrypted using SRTP (Secure Real-time Transport Protocol) to prevent packet capture tools from reconstructing voice audio.

MINI LESSON: VoIP Traffic Pattern Recognition

When analyzing VoIP traffic, defenders should separate the communication into two distinct phases: Signaling and Media.

Signaling (SIP, H.323): Used to set up, manage, and tear down the call. Operates typically on TCP/UDP 5060 or 5061 (TLS). Traffic is sporadic and bursty.
Media (RTP - Real-time Transport Protocol): The actual digitized voice payload. Operates on a wide range of high UDP ports. Traffic is continuous, steady, and highly sensitive to jitter and packet loss.

Anomalous high-volume SIP traffic usually indicates a brute-force or enumeration attack against the SIP registrar, while anomalous RTP traffic might indicate a denial-of-service against the media gateways.

Explore more CND simulations to sharpen your network defense skills.

View Practice Tests