1|Page
3CX Institute State-of-the-Art Certification
Exam | 300 Verified Multiple-Choice Q&A
with In-Depth Rationales | 2026/2027
Update | Advanced SIP & VoIP Mastery
Pass the 3CX Advanced Certification on your first attempt with
this definitive 2026 test bank!
This document delivers 300 rigorously crafted multiple-choice
questions covering the entire State-of-the-Art syllabus. Each
question includes a bolded correct answer paired with a
detailed, exam-style rationale—explaining exactly why the
answer is correct and why the distractors are wrong. Master
critical topics including Session Border Controllers (SBC) ,
TLS/SRTP encryption, Outbound Rules, NAT Traversal, Call
Queues, and High Availability failover. Avoid common pitfalls
with real-world scenario-based queries used by top engineering
schools. Whether you are a 3CX Partner or an IT student, this
comprehensive Q&A set guarantees you understand the core
architecture of 3CX V20, VoIP security, and advanced SIP proxy
management. Ace your exam, boost your resume, and save
hundreds of study hours with this proven, instant-download
resource tailored for 2026 certification standards
,2|Page
Question 1
Which of the following best describes the primary function of the 3CX Session Border
Controller (SBC) in a typical deployment?
A) To encrypt all internal extension-to-extension calls within the local LAN.
B) To act as a failover server in case the primary 3CX PBX instance becomes
unavailable.
C) To securely connect remote endpoints and IP phones to the 3CX PBX without
requiring a full VPN tunnel, while also handling NAT traversal.
D) To replace the need for a firewall by filtering all SIP and RTP traffic at the network
perimeter.
Answer: C
Rationale: The 3CX SBC is a lightweight software appliance that proxies SIP and RTP
traffic between remote phones and the PBX, simplifying NAT traversal and eliminating
VPN requirements. It does not replace firewalls, handle failover, or primarily encrypt
internal LAN calls.
Question 2
When configuring outbound rules in 3CX, what is the effect of using comma-
separated values in the "Calls from Extension(s)" field?
A) It allows the rule to apply only to the first extension listed.
B) It restricts the rule to extensions within a single range only.
C) It enables the rule to apply to multiple individual extensions or extension ranges.
D) It disables the rule for all listed extensions.
Answer: C
Rationale: Comma-separated values in the "Calls from Extension(s)" field allow you to
define multiple specific extensions or ranges (e.g., 100,102,105-110). This provides
flexible targeting for outbound route matching.
Question 3
By default, how does 3CX handle audio delivery between two extensions that are
registered over different site-to-site VPNs and reside on different subnets?
A) Audio is always forced through the 3CX PBX server.
B) Audio is delivered directly between the phones (peer-to-peer) if possible.
C) Audio is routed via the public internet without any encryption.
,3|Page
D) Audio is blocked entirely for security reasons.
Answer: B
Rationale: By default, 3CX attempts to establish direct media (peer-to-peer) between
endpoints when possible, even across subnets, to reduce server load. However, this
behavior can be overridden with media relay settings.
Question 4
What must be configured on a 3CX system to enable Secure SIP (SIPS) for all
incoming and outgoing calls?
A) Enable "Transport Security" under each trunk and extension, and configure valid
TLS certificates.
B) Only enable SRTP on the PBX general settings page.
C) Disable all UDP and TCP ports and use only port 5061.
D) Enable STUN globally and disable all non-secure codecs.
Answer: A
Rationale: Secure SIP requires TLS transport to be enabled on trunks and extensions,
along with a valid certificate. SRTP handles media encryption, but SIPS specifically
secures the signaling layer.
Question 5
In a 3CX high-availability (HA) deployment, what is the role of the "Standby" server?
A) It handles all incoming calls while the primary handles outgoing.
B) It runs active call processing in parallel to load-balance traffic.
C) It remains inactive and synchronizes configuration and voicemail data, taking over
only if the primary fails.
D) It acts as an SBC for remote locations.
Answer: C
Rationale: In 3CX HA (Enterprise edition), the standby server synchronizes with the
primary via database replication and fails over automatically when the primary
becomes unreachable. It does not process calls during normal operation.
Question 6
Which codec does 3CX recommend as the default for best balance between
bandwidth usage and voice quality?
A) G.711
, 4|Page
B) G.722
C) Opus
D) G.729
Answer: A
Rationale: G.711 (PCMU/PCMA) is the default recommendation because it delivers toll-
quality audio at 64 kbps per stream and requires minimal CPU processing. G.729 and
Opus are used for low-bandwidth scenarios.
Question 7
When using a 3CX bridge between two PBX systems, which protocol is required for
secure inter-PBX communication?
A) Only SIP over UDP
B) SIP over TLS with mutual authentication
C) IAX2 over TCP
D) H.323 over RTP
Answer: B
Rationale: 3CX bridges use SIP over TLS by default, with mutual certificate
authentication to ensure encrypted and trusted signaling between two separate 3CX
installations.
Question 8
What happens to a call when a 3CX extension user toggles "Do Not Disturb" (DND)
while already on an active call?
A) The active call is immediately dropped.
B) The active call continues normally, but new incoming calls are rejected.
C) The active call is put on hold and the caller is prompted to hang up.
D) The DND toggle has no effect until the user hangs up.
Answer: B
Rationale: Enabling DND does not affect existing active calls. It only prevents new calls
from ringing the extension. The user remains connected until the current call ends.
Question 9
Which 3CX feature allows an administrator to monitor real-time call statistics, queue
performance, and system health via a web dashboard?
A) 3CX Call Flow Designer
3CX Institute State-of-the-Art Certification
Exam | 300 Verified Multiple-Choice Q&A
with In-Depth Rationales | 2026/2027
Update | Advanced SIP & VoIP Mastery
Pass the 3CX Advanced Certification on your first attempt with
this definitive 2026 test bank!
This document delivers 300 rigorously crafted multiple-choice
questions covering the entire State-of-the-Art syllabus. Each
question includes a bolded correct answer paired with a
detailed, exam-style rationale—explaining exactly why the
answer is correct and why the distractors are wrong. Master
critical topics including Session Border Controllers (SBC) ,
TLS/SRTP encryption, Outbound Rules, NAT Traversal, Call
Queues, and High Availability failover. Avoid common pitfalls
with real-world scenario-based queries used by top engineering
schools. Whether you are a 3CX Partner or an IT student, this
comprehensive Q&A set guarantees you understand the core
architecture of 3CX V20, VoIP security, and advanced SIP proxy
management. Ace your exam, boost your resume, and save
hundreds of study hours with this proven, instant-download
resource tailored for 2026 certification standards
,2|Page
Question 1
Which of the following best describes the primary function of the 3CX Session Border
Controller (SBC) in a typical deployment?
A) To encrypt all internal extension-to-extension calls within the local LAN.
B) To act as a failover server in case the primary 3CX PBX instance becomes
unavailable.
C) To securely connect remote endpoints and IP phones to the 3CX PBX without
requiring a full VPN tunnel, while also handling NAT traversal.
D) To replace the need for a firewall by filtering all SIP and RTP traffic at the network
perimeter.
Answer: C
Rationale: The 3CX SBC is a lightweight software appliance that proxies SIP and RTP
traffic between remote phones and the PBX, simplifying NAT traversal and eliminating
VPN requirements. It does not replace firewalls, handle failover, or primarily encrypt
internal LAN calls.
Question 2
When configuring outbound rules in 3CX, what is the effect of using comma-
separated values in the "Calls from Extension(s)" field?
A) It allows the rule to apply only to the first extension listed.
B) It restricts the rule to extensions within a single range only.
C) It enables the rule to apply to multiple individual extensions or extension ranges.
D) It disables the rule for all listed extensions.
Answer: C
Rationale: Comma-separated values in the "Calls from Extension(s)" field allow you to
define multiple specific extensions or ranges (e.g., 100,102,105-110). This provides
flexible targeting for outbound route matching.
Question 3
By default, how does 3CX handle audio delivery between two extensions that are
registered over different site-to-site VPNs and reside on different subnets?
A) Audio is always forced through the 3CX PBX server.
B) Audio is delivered directly between the phones (peer-to-peer) if possible.
C) Audio is routed via the public internet without any encryption.
,3|Page
D) Audio is blocked entirely for security reasons.
Answer: B
Rationale: By default, 3CX attempts to establish direct media (peer-to-peer) between
endpoints when possible, even across subnets, to reduce server load. However, this
behavior can be overridden with media relay settings.
Question 4
What must be configured on a 3CX system to enable Secure SIP (SIPS) for all
incoming and outgoing calls?
A) Enable "Transport Security" under each trunk and extension, and configure valid
TLS certificates.
B) Only enable SRTP on the PBX general settings page.
C) Disable all UDP and TCP ports and use only port 5061.
D) Enable STUN globally and disable all non-secure codecs.
Answer: A
Rationale: Secure SIP requires TLS transport to be enabled on trunks and extensions,
along with a valid certificate. SRTP handles media encryption, but SIPS specifically
secures the signaling layer.
Question 5
In a 3CX high-availability (HA) deployment, what is the role of the "Standby" server?
A) It handles all incoming calls while the primary handles outgoing.
B) It runs active call processing in parallel to load-balance traffic.
C) It remains inactive and synchronizes configuration and voicemail data, taking over
only if the primary fails.
D) It acts as an SBC for remote locations.
Answer: C
Rationale: In 3CX HA (Enterprise edition), the standby server synchronizes with the
primary via database replication and fails over automatically when the primary
becomes unreachable. It does not process calls during normal operation.
Question 6
Which codec does 3CX recommend as the default for best balance between
bandwidth usage and voice quality?
A) G.711
, 4|Page
B) G.722
C) Opus
D) G.729
Answer: A
Rationale: G.711 (PCMU/PCMA) is the default recommendation because it delivers toll-
quality audio at 64 kbps per stream and requires minimal CPU processing. G.729 and
Opus are used for low-bandwidth scenarios.
Question 7
When using a 3CX bridge between two PBX systems, which protocol is required for
secure inter-PBX communication?
A) Only SIP over UDP
B) SIP over TLS with mutual authentication
C) IAX2 over TCP
D) H.323 over RTP
Answer: B
Rationale: 3CX bridges use SIP over TLS by default, with mutual certificate
authentication to ensure encrypted and trusted signaling between two separate 3CX
installations.
Question 8
What happens to a call when a 3CX extension user toggles "Do Not Disturb" (DND)
while already on an active call?
A) The active call is immediately dropped.
B) The active call continues normally, but new incoming calls are rejected.
C) The active call is put on hold and the caller is prompted to hang up.
D) The DND toggle has no effect until the user hangs up.
Answer: B
Rationale: Enabling DND does not affect existing active calls. It only prevents new calls
from ringing the extension. The user remains connected until the current call ends.
Question 9
Which 3CX feature allows an administrator to monitor real-time call statistics, queue
performance, and system health via a web dashboard?
A) 3CX Call Flow Designer
