CND (312-38) Network Defense Simulation

Network Scenario

You are a Network Security Analyst monitoring the perimeter firewall of a mid-sized enterprise. The company recently transitioned from traditional PBX telephony to a unified communications platform. You notice a significant increase in sustained UDP connections traversing the firewall from internal endpoints to an external provider.

Simultaneously, the IDS has generated low-level alerts regarding anomalous traffic bursts on specific ports. Before determining if this is a covert exfiltration channel or legitimate traffic, you must identify the underlying technology powering the organization's new communication infrastructure.

Traffic & Logs

Question

Hint: Look at the IDS alerts in the log block. They specifically mention terms related to Voice protocols and SIP (Session Initiation Protocol).

Expert Analysis

1. What is happening in the network

The firewall is passing UDP port 5060 traffic (Session Initiation Protocol - SIP) to establish call signaling, followed by UDP traffic in the ephemeral port range (10000-20000), which is Real-time Transport Protocol (RTP) carrying the actual voice payload. Concurrently, the IDS is flagging potential SIP INVITE flooding and unauthorized responses, indicating a possible brute-force or toll fraud attack against the communication infrastructure.

2. Identify attack or behavior

The legitimate baseline behavior is IP Telephony. The anomalous behavior represents SIP enumeration/toll fraud—attackers scanning the internet for exposed PBX systems to route free calls or harvest credentials.

3. Why correct answer is correct

VoIP (Voice over IP) is the correct term. It defines the methodology and group of technologies for the delivery of voice communications and multimedia sessions over Internet Protocol (IP) networks, bypassing traditional PSTN (Public Switched Telephone Network) lines.

4. Why others are wrong

• VPN (Virtual Private Network): Used for creating encrypted tunnels across public networks, not specifically for routing voice conversations natively.
• VLAN (Virtual Local Area Network): A Layer 2 concept used to logically segment broadcast domains, often used to separate voice traffic (Voice VLANs) from data, but not the routing protocol itself.
• SMTP (Simple Mail Transfer Protocol): Used for routing email traffic, not real-time voice communications.

5. Defensive action

To secure this environment, the network defender should implement a Session Border Controller (SBC) at the network edge to inspect and filter SIP traffic. Additionally, the infrastructure should transition from unencrypted SIP/RTP to SIPS (SIP over TLS) for signaling and SRTP (Secure RTP) for the media payload to prevent eavesdropping (packet sniffing) and tampering.