Which mechanism do you use to implement calling privileges on Cisco Unified Communications Manager Express?

A.
CoS

B.
QoS

C.
CAC

D.
COR

E.
SRST

Explanation:
Calling privileges define the destination a user is allowed to dial and they are implemented on Cisco IOS gateway using Class of Restriction.

Class of Restriction (COR) is the feature that determines which numbers might not be dialed on the system. COR is required only when you want to restrict the ability of some phones to make certain types of calls but allow other phones to place those calls. COR functionality provides the ability to deny certain call attempts on the basis of the incoming and outgoing CORs that are provisioned on the dial-peers. This functionality provides flexibility in network design, allows users to block calls (for example, calls to 900 numbers), and applies different restrictions to call attempts from different originators.

(Reference: http://www.cisco.com/en/US/tech/tk652/tk90/technologies_configuration_example09186a008019d649.shtml)