Security and Compliance
What this domain tests
Security and Compliance covers protecting voice infrastructure and meeting regulatory obligations. Candidates must understand signaling and media encryption (TLS for signaling, SRTP for media), authentication and authorization for endpoints and administrators, and fraud controls such as toll-fraud prevention and rate limiting. Know the vocabulary of compliance: data retention, consent and recording rules, access logging, and auditability. Understand that voice systems carry both metadata and content, and each may have different handling requirements. A strong candidate can map a control to the risk it reduces and the obligation it satisfies.
Traps to watch
Questions frequently test whether you can distinguish encryption in transit from protection at rest; encrypting signaling does not encrypt media. Another trap is treating compliance as purely technical; consent and retention are policy questions that technology must enforce. Watch for fraud scenarios disguised as configuration questions, such as an exposed trunk that permits international dialing. Also beware answers that add logging without considering whether the logs themselves contain sensitive content subject to retention rules.
Worked rule of thumb
Apply least privilege to every path into the system: trunks, endpoints, and admin interfaces. For example, restrict outbound trunk dialing to approved destinations and patterns, then monitor for anomalies. This single control reduces toll fraud, limits blast radius if credentials leak, and produces auditable evidence for compliance reviews. If a stem describes unexpected international charges, check trunk permissions and credential hygiene first.
Study focus
Prioritize encryption boundaries, authentication, fraud prevention, and the policy side of compliance.