CCNP Collaboration 350-801 CLCOR Practice Test 10

Correct Answer: An attacker who gains access to an internal extension or a compromised voicemail system could place expensive international calls that are billed to the organization
Explanation: Unrestricted international access creates exposure to costly fraudulent calls if an extension or voicemail system is compromised, unlike automatically encrypting calls, improving audio quality, reducing WAN usage, disabling voicemail, or increasing available directory numbers.

Correct Answer: Forced Authorization Code (FAC)
Explanation: Forced Authorization Code (FAC) requires entering a valid code before completing a call matching a specific pattern, unlike badge number entry, printed forms, a fixed delay, spoken passphrases, or calendar-based scheduling, none of which are actual FAC mechanisms.

Correct Answer: A voicemail box configured with a default, weak, or unchanged PIN and an enabled outcalling or transfer-to-external-number feature, which an attacker could exploit to place outbound calls
Explanation: A weak/default PIN combined with enabled outcalling or external transfer creates a toll fraud vector attackers can exploit, unlike a longer greeting, storing multiple messages, notification lamp color, email notifications for new messages, or custom hold music.

Correct Answer: Restricting or disabling after-hours access to outbound trunks via time-of-day routing, combined with requiring authentication (such as a FAC or PIN) for any remaining after-hours external access
Explanation: Time-of-day routing restricting after-hours trunk access, combined with authentication for any remaining access, reduces fraud risk, unlike leaving trunks fully open at all hours, adding more trunks without restrictions, disabling CDR logging, removing redundancy, or using a shared PIN for everyone.

Correct Answer: Reviewing call detail records (CDRs) and billing data for unusual patterns, such as a spike in international or premium-rate calls, calls placed at unusual hours, or high call volume from a single extension
Explanation: Reviewing CDRs and billing data for unusual call patterns helps detect ongoing toll fraud, unlike reviewing admin portal font, phone wallpaper, ringtone assignments, self-care portal color scheme, or IT parking space counts.

Correct Answer: Assigning that phone a restrictive calling search space that only includes partitions for internal and local route patterns, excluding partitions for international or premium-rate patterns
Explanation: A restrictive CSS limited to internal/local partitions appropriately scopes a shared phone's calling ability, unlike granting an unrestricted executive-level CSS, removing CSS restriction entirely, limiting to only conferencing bridges, basing assignment on desk color, or choosing by highest partition ID.

Correct Answer: The unattended extension or voicemail box could be exploited by an attacker for unauthorized outbound calling or as a foothold to access other systems, since it remains active with no legitimate user monitoring it
Explanation: An unattended, still-active extension or voicemail box is a toll fraud and security exposure since no legitimate user is monitoring it, unlike automatic renumbering, automatic conversion to a conference bridge, automatic call quality improvement, reduced WAN usage, or increased available directory numbers, none of which reflect the actual risk.

Correct Answer: Restrictive calling search spaces limiting which devices can reach international/premium-rate route patterns, forced authorization codes for any remaining authorized access, and regular CDR review for anomalous usage patterns
Explanation: Restrictive CSS scoping, FAC for remaining access, and regular CDR review together provide layered protection, unlike a shared PIN for everyone, unrestricted access from every CSS, disabling CDR generation, giving every phone an unrestricted admin-level CSS, or relying solely on employee honesty.

Correct Answer: Investigate whether that phone's calling search space or route pattern configuration was recently and improperly changed, and whether the physical phone or its line has shown any signs of tampering or unauthorized access
Explanation: Investigating whether the CSS/route pattern configuration was improperly changed, and checking for tampering, is the appropriate response to unexpected international call activity, unlike blaming desk placement, replacing hardware without reviewing configuration, dismissing the spike as expected, blaming lobby lighting, or blaming the phase of the moon.

Correct Answer: Preventive controls such as restrictive CSS and FAC reduce the initial attack surface, but configuration drift, newly compromised credentials, or unforeseen gaps can still create exposure over time, so ongoing CDR review and monitoring are needed to catch fraud that preventive controls did not stop
Explanation: Preventive controls reduce the attack surface but cannot address configuration drift or unforeseen gaps, so ongoing monitoring catches what prevention misses, unlike treating the two as identical, claiming prevention alone guarantees zero fraud, claiming monitoring alone guarantees zero fraud, claiming risk is eliminated permanently at first configuration, or denying monitoring's value once controls exist.