Exam CISSP topic 1 question 220 discussion

i think the goal is to secure phones from unauth usage and you have to lock the phones down. It doesnt say that (A) locks it down. the CDR reports tracks usage but that doesnt prevent usage.

The best solution is Option A because it ensures that the PIN codes are changed regularly, making it difficult for unauthorized users to access the phone system; additionally, implementing call detail records (CDR) reports allows for tracking of phone usage, which can be used to identify any unauthorized usage and take appropriate action. Option C, using phone locking software, may be a good additional measure, but it is not a complete solution on its own. Option B, having the administrator change the PIN regularly, is not practical as it would be difficult to manage and may cause confusion for users. Option D, implementing CDR reports alone, does not address the issue of unauthorized usage and does not provide a way to prevent it in the first place.

can a "Unique" personal ID number be changed arbitrarily? what if two users picked a same PIN? how to distinguish them?

A is correct

The best solution would be to have the administrator enforce a policy to change the PIN regularly and implement call detail records (CDR) reports to track usage. This would help to prevent unauthorized phone usage and allow the organization to monitor and track usage. Option A would be effective in securing the VoIP phones and ensuring that they are being used appropriately.

A is correct

A vs B, A is enforce - best solution

Did you notice the catch in the answers for A and B? A is to enforce a policy (Applies to all users) to change the PIN regularly. B is to have the administrator's PIN to be changed only. The question says that the "Administrators have assigned unique personal identification number (PIN) codes for each person in the organization". You can't ask the Administrator to change everyone's unique PIN by himself. The given answer is correct.

The administrator does not create policy, he simply enforces it.