The primary concern for an IS auditor regarding a Voice-over IP (VoIP) implementation is the concentration of risk. By migrating voice communications to the same network that carries data, the organization creates a single point of failure. A significant network outage would simultaneously disrupt both critical voice and data services, severely impacting business operations and continuity. From an audit perspective, this risk to availability is the most fundamental and high-impact concern, as it represents a major architectural vulnerability that could halt all primary forms of electronic communication.

B. VoIP traffic can be securely transmitted over virtual private networks (VPNs); an inability to do so is not an inherent limitation of the technology.
C. The fundamental concept of VoIP is the integration of voice and data communications onto a single network, making this statement contradictory.
D. While voice quality degradation is a valid technical and operational issue, the complete loss of service from a single point of failure represents a far greater business risk.

1. ISACA

CISA Review Manual

27th Edition

2019

Domain 4: Information Systems Operations and Business Resilience

Section 4.2.4 Network Management

page 268. The manual states

"The primary risk of VoIP is that it is another service that is dependent on the availability of the data network. If the network is unavailable

both data and voice communications will be lost."

2. Al-kahtani

M. S.

Al-bakr

A. M.

& Al-sewari

A. A. (2020). "A Comprehensive Overview of Voice over IP (VoIP) Security." Journal of Information Security and Applications

52

102483. Section 3.1

Availability Attacks. The paper notes that because VoIP shares the same infrastructure as data

"any attack that affects the data network will also affect the VoIP service

" highlighting the shared dependency and single point of failure risk. (https://doi.org/10.1016/j.jisa.2020.102483)