3CX Academy Advanced Certification Exam 2026/2027 – 100
Verified Questions and Answers with Detailed Rationales
Graded A
Pass the 3CX Academy Advanced Certification Exam on your first attempt with this
comprehensive 2026/2027 practice test featuring 100 verified questions and detailed
Rationales that explain WHY each answer is correct. Covering SIP trunk configuration,
outbound/inbound rules, call queues, IVR, firewall and SBC setup, Wireshark troubleshooting,
security hardening, VPN audio routing, and v20 features – this document mirrors the actual
exam format to build your confidence and technical mastery. Each question is crafted for IT
professionals, VoIP administrators, system engineers, and telecom specialists seeking official
3CX certification. Updated for the new 3CX Academy with AI, transcription, and the latest
deployment scenarios. A+ guaranteed – master advanced PBX administration, multi-site
bridging, codec prioritization, and real-world troubleshooting scenarios. Perfect for self-study,
exam prep, or quick review.
,Q1. When configuring a SIP trunk in 3CX, which setting determines the IP address or FQDN that
3CX will send INVITE messages to for outbound calls?
A) Registrar Hostname
B) Outbound Proxy
C) Authentication ID
D) SIP Domain
Answer: B) Outbound Proxy
Rationale: The Outbound Proxy is the specific server IP/FQDN to which 3CX sends all SIP requests
(INVITES, BYE, etc.). The Registrar Hostname (A) is used only for registration, not for routing
each call.
Q2. During a Wireshark capture, you see a SIP 407 Proxy Authentication Required response.
What does this indicate?
A) The extension is blocked
B) The SIP trunk requires digest authentication before proceeding
C) The firewall is dropping packets
D) The codec is unsupported
Answer: B) The SIP trunk requires digest authentication before proceeding
Rationale: A 407 response is a challenge from the proxy/server asking the client (3CX) to resend
the INVITE with valid authentication credentials (username/password).
Q3. In 3CX Split DNS (horizontal) architecture, what is the primary purpose?
A) To load balance web clients across multiple data centers
B) To resolve the FQDN to a public IP when external and a private IP when internal
C) To encrypt all RTP traffic between extensions
D) To automatically update firewall rules
Answer: B) To resolve the FQDN to a public IP when external and a private IP when internal
Rationale: Split DNS ensures that internal phones connect directly via the LAN IP (avoiding
hairpinning), while external clients connect via the public IP, all using the same FQDN.
Q4. Which codec is most recommended for WAN (external) connections in 3CX to balance
quality and bandwidth?
A) G.711 u-law
B) G.722
,C) OPUS
D) G.729
Answer: D) G.729
Rationale: G.729 compresses voice to about 8 kbps, using significantly less bandwidth than
G.711 (64 kbps), making it ideal for internet/WAN links where bandwidth is limited.
Q5. You are troubleshooting a one-way audio issue. The caller can hear the recipient, but the
recipient cannot hear the caller. Which is the MOST likely cause?
A) The caller's firewall is not sending RTP packets
B) The recipient's firewall is blocking inbound RTP ports (or the caller's SIP ALG is mangling the
SDP)
C) The SIP port (5060) is closed
D) The DNS resolution is failing
Answer: B) The recipient's firewall is blocking inbound RTP ports (or the caller's SIP ALG is
mangling the SDP)
Rationale: If the recipient cannot hear the caller, the caller's RTP stream is not reaching the
recipient. This is almost always due to the recipient's firewall blocking the inbound RTP ports or
SIP ALG corrupting the SDP where the IP address is advertised.
Q6. When configuring a Call Queue, what does the "Slip Time" parameter control?
A) How long a call rings before going to voicemail
B) The interval between ring attempts to agents
C) The maximum wait time before a call is forced to overflow
D) The delay before an agent is considered "available" after finishing a call
Answer: B) The interval between ring attempts to agents
Rationale: Slip Time defines how long the system waits before moving to the next agent or next
strategy step. For example, if set to 15 seconds, it rings Agent A for 15s, then moves to Agent B.
Q7. In 3CX v20, what is the primary management interface used for system configuration?
A) The Legacy Windows Console
B) The Web Administration Panel (https://FQDN:5001)
C) The Smartphone App
D) The Command Line Interface (CLI)
, Answer: B) The Web Administration Panel (https://FQDN:5001)
Rationale: As of v20, 3CX has fully transitioned to a web-based administrative interface. The
legacy Windows Management Console is deprecated.
Q8. Which SIP header is used by 3CX to carry the original caller's number (Caller ID) to the trunk
provider?
A) From
B) To
C) Remote-Party-ID
D) P-Asserted-Identity
Answer: C) Remote-Party-ID
Rationale: 3CX uses the Remote-Party-ID (RPID) header to pass the calling party number and
name. Many providers also accept P-Asserted-Identity, but RPID is the traditional 3CX standard.
Q9. What is the default SIP port used by 3CX for extension registration and call signaling?
A) 5060
B) 5061
C) 5090
D) 9000
Answer: A) 5060
Rationale: 5060 is the standard, unencrypted SIP port. 5061 is for TLS (encrypted) SIP, and 5090
is the 3CX Tunnel port.
Q10. How does 3CX handle failover if a primary SIP trunk provider goes down?
A) It automatically reroutes calls to the secondary trunk if configured in Outbound Rules
B) It sends a notification email and stops all calls
C) It reroutes to voicemail
D) It uses STUN to find a new provider
Answer: A) It automatically reroutes calls to the secondary trunk if configured in Outbound
Rules
Rationale: Outbound Rules have a "Provider" order. If the first trunk fails (e.g., Registration fails
or 503 response), 3CX automatically fails over to the next trunk in the list.
Verified Questions and Answers with Detailed Rationales
Graded A
Pass the 3CX Academy Advanced Certification Exam on your first attempt with this
comprehensive 2026/2027 practice test featuring 100 verified questions and detailed
Rationales that explain WHY each answer is correct. Covering SIP trunk configuration,
outbound/inbound rules, call queues, IVR, firewall and SBC setup, Wireshark troubleshooting,
security hardening, VPN audio routing, and v20 features – this document mirrors the actual
exam format to build your confidence and technical mastery. Each question is crafted for IT
professionals, VoIP administrators, system engineers, and telecom specialists seeking official
3CX certification. Updated for the new 3CX Academy with AI, transcription, and the latest
deployment scenarios. A+ guaranteed – master advanced PBX administration, multi-site
bridging, codec prioritization, and real-world troubleshooting scenarios. Perfect for self-study,
exam prep, or quick review.
,Q1. When configuring a SIP trunk in 3CX, which setting determines the IP address or FQDN that
3CX will send INVITE messages to for outbound calls?
A) Registrar Hostname
B) Outbound Proxy
C) Authentication ID
D) SIP Domain
Answer: B) Outbound Proxy
Rationale: The Outbound Proxy is the specific server IP/FQDN to which 3CX sends all SIP requests
(INVITES, BYE, etc.). The Registrar Hostname (A) is used only for registration, not for routing
each call.
Q2. During a Wireshark capture, you see a SIP 407 Proxy Authentication Required response.
What does this indicate?
A) The extension is blocked
B) The SIP trunk requires digest authentication before proceeding
C) The firewall is dropping packets
D) The codec is unsupported
Answer: B) The SIP trunk requires digest authentication before proceeding
Rationale: A 407 response is a challenge from the proxy/server asking the client (3CX) to resend
the INVITE with valid authentication credentials (username/password).
Q3. In 3CX Split DNS (horizontal) architecture, what is the primary purpose?
A) To load balance web clients across multiple data centers
B) To resolve the FQDN to a public IP when external and a private IP when internal
C) To encrypt all RTP traffic between extensions
D) To automatically update firewall rules
Answer: B) To resolve the FQDN to a public IP when external and a private IP when internal
Rationale: Split DNS ensures that internal phones connect directly via the LAN IP (avoiding
hairpinning), while external clients connect via the public IP, all using the same FQDN.
Q4. Which codec is most recommended for WAN (external) connections in 3CX to balance
quality and bandwidth?
A) G.711 u-law
B) G.722
,C) OPUS
D) G.729
Answer: D) G.729
Rationale: G.729 compresses voice to about 8 kbps, using significantly less bandwidth than
G.711 (64 kbps), making it ideal for internet/WAN links where bandwidth is limited.
Q5. You are troubleshooting a one-way audio issue. The caller can hear the recipient, but the
recipient cannot hear the caller. Which is the MOST likely cause?
A) The caller's firewall is not sending RTP packets
B) The recipient's firewall is blocking inbound RTP ports (or the caller's SIP ALG is mangling the
SDP)
C) The SIP port (5060) is closed
D) The DNS resolution is failing
Answer: B) The recipient's firewall is blocking inbound RTP ports (or the caller's SIP ALG is
mangling the SDP)
Rationale: If the recipient cannot hear the caller, the caller's RTP stream is not reaching the
recipient. This is almost always due to the recipient's firewall blocking the inbound RTP ports or
SIP ALG corrupting the SDP where the IP address is advertised.
Q6. When configuring a Call Queue, what does the "Slip Time" parameter control?
A) How long a call rings before going to voicemail
B) The interval between ring attempts to agents
C) The maximum wait time before a call is forced to overflow
D) The delay before an agent is considered "available" after finishing a call
Answer: B) The interval between ring attempts to agents
Rationale: Slip Time defines how long the system waits before moving to the next agent or next
strategy step. For example, if set to 15 seconds, it rings Agent A for 15s, then moves to Agent B.
Q7. In 3CX v20, what is the primary management interface used for system configuration?
A) The Legacy Windows Console
B) The Web Administration Panel (https://FQDN:5001)
C) The Smartphone App
D) The Command Line Interface (CLI)
, Answer: B) The Web Administration Panel (https://FQDN:5001)
Rationale: As of v20, 3CX has fully transitioned to a web-based administrative interface. The
legacy Windows Management Console is deprecated.
Q8. Which SIP header is used by 3CX to carry the original caller's number (Caller ID) to the trunk
provider?
A) From
B) To
C) Remote-Party-ID
D) P-Asserted-Identity
Answer: C) Remote-Party-ID
Rationale: 3CX uses the Remote-Party-ID (RPID) header to pass the calling party number and
name. Many providers also accept P-Asserted-Identity, but RPID is the traditional 3CX standard.
Q9. What is the default SIP port used by 3CX for extension registration and call signaling?
A) 5060
B) 5061
C) 5090
D) 9000
Answer: A) 5060
Rationale: 5060 is the standard, unencrypted SIP port. 5061 is for TLS (encrypted) SIP, and 5090
is the 3CX Tunnel port.
Q10. How does 3CX handle failover if a primary SIP trunk provider goes down?
A) It automatically reroutes calls to the secondary trunk if configured in Outbound Rules
B) It sends a notification email and stops all calls
C) It reroutes to voicemail
D) It uses STUN to find a new provider
Answer: A) It automatically reroutes calls to the secondary trunk if configured in Outbound
Rules
Rationale: Outbound Rules have a "Provider" order. If the first trunk fails (e.g., Registration fails
or 503 response), 3CX automatically fails over to the next trunk in the list.
