3CX Basic Certification Exam
Questions and Verified Answers | A Grade
Latest 2026/2027 Update | Aligned with the 3CX Academy Basic Certification Curriculum (3CX v20) | 100 Questions
with Comprehensive Rationales
Exam Overview
Section Coverage Focus Questions
Section 1: System Fundamentals, Installation and OS Requirements, FQDN, Deployment
Q1 - Q20
Requirements Models, License Types, Virtualization
Section 2: Networking, Firewall and Port Port Requirements, NAT, Firewall
Q21 - Q35
Configuration Rules, SIP ALG, STUN
SIP Protocol, Codecs, SIP Trunk
Section 3: SIP Trunking and VoIP Fundamentals Configuration, Registration, Q36 - Q55
Troubleshooting
Extension Configuration, DIDs,
Section 4: Extension Management and Call Routing Inbound/Outbound Rules, Digital Q56 - Q75
Receptionist, Ring Groups
Section 5: Security, Maintenance and Anti-Hacking, Backup/Restore, Firewall
Q76 - Q85
Troubleshooting Checker, Security Best Practices
Section 6: 3CX Apps, Remote Connectivity and 3CX App Provisioning, Tunnel, SBC,
Q86 - Q100
SBC WebRTC, Web Client
SECTION 1 Questions 1-20
System Fundamentals, Installation and Requirements
Coverage: OS Requirements, FQDN, Deployment Models, License Types, Virtualization
Q1: Before installing and activating a 3CX v20 PBX, which prerequisite ensures that remote
phones, apps and the Let's Encrypt certificate service can all reach the system?
A. A fully qualified domain name (FQDN) that resolves publicly on the internet,
together with proper firewall configuration [CORRECT]
B. A static NetBIOS computer name registered in the local workgroup
C. A Microsoft Active Directory domain joined to the same forest
D. A licensed hardware VPN concentrator placed in front of the server
Correct Answer: A
Rationale: 3CX mandates an FQDN with public DNS resolvability plus correctly configured firewall
ports as installation prerequisites. The FQDN is what phones, apps and the provisioning service use to
Questions and Verified Answers | A Grade 1
,3CX Basic Certification 2026/2027 Exam Verified Answers Edition
reach the PBX, and it is also the name bound into the SSL certificate, so a NetBIOS name or AD
membership cannot substitute. A VPN concentrator is not part of the 3CX architecture and adds no
certificate or provisioning capability. Without a publicly resolvable FQDN, activation and certificate
issuance simply fail.
Q2: Which operating system is the primary supported platform for a fresh 3CX v20
installation?
A. Ubuntu Server 22.04 LTS (64-bit)
B. Debian 11 (64-bit) [CORRECT]
C. CentOS Stream 9 (64-bit)
D. Red Hat Enterprise Linux 8 (64-bit)
Correct Answer: B
Rationale: Debian 11 (64-bit) is the primary, officially blessed platform for v20 installations and
receives the smoothest tested upgrade path. Ubuntu, CentOS Stream and RHEL are not part of the
v20 supported OS list, so installs on them are unsupported even if the script appears to run. Windows
Server 2019 or newer is also supported, but only as a secondary platform. Choosing the primary
platform keeps the installation covered by 3CX support and automated updates.
Q3: A hosting provider wants to deploy dozens of customer PBXs on its existing
virtualization farm. Which set of virtualization platforms is officially supported for running
3CX?
A. VirtualBox, VMware Workstation and Parallels Desktop
B. Docker, LXC and other container runtimes
C. Hyper-V, VMware ESXi, KVM and XenServer (Citrix Hypervisor)
[CORRECT]
D. Only Microsoft Azure VMs of the B-series family
Correct Answer: C
Rationale: 3CX supports the enterprise hypervisors Hyper-V, ESXi, KVM and XenServer, which are
the platforms tested for media timing and performance. Desktop hypervisors such as VirtualBox,
VMware Workstation and Parallels are not supported because their clock and network handling is
unreliable for real-time RTP. Container runtimes like Docker and LXC are likewise unsupported
deployment forms. A cloud provider restriction such as a specific Azure VM family is not a 3CX
support statement.
Questions and Verified Answers | A Grade 2
,3CX Basic Certification 2026/2027 Exam Verified Answers Edition
Q4: A business requires up to 64 simultaneous calls on its PBX. Which 3CX license edition is
the minimum that supports this capacity?
A. Free edition
B. Standard edition (16 simultaneous calls)
C. Pro edition (64 simultaneous calls) [CORRECT]
D. Enterprise edition (unlimited calls only)
Correct Answer: C
Rationale: The Pro edition key is licensed for 64 simultaneous calls (SC), which exactly matches the
stated requirement. The Standard edition is capped at 16 SC, so it would block call setup once the
limit is reached. The Free edition is a small starter key and cannot reach 64 SC either. Enterprise is
positioned above Pro, so Pro is the minimum edition that satisfies the requirement without paying for
Enterprise.
Q5: A growing dental practice measured its busy-hour peak at 14 simultaneous calls and
wants the lowest-cost official edition that still covers that figure. Which license should the
administrator procure?
A. Standard edition, licensed for 16 simultaneous calls [CORRECT]
B. Pro edition, licensed for 64 simultaneous calls
C. Enterprise edition, because only it supports clinics
D. Free edition, since it includes the same call capacity with limited features
Correct Answer: A
Rationale: The Standard edition covers 16 simultaneous calls, which comfortably fits the measured
14-call peak at the lowest cost point. The Pro edition also covers the load but costs more than
necessary for this requirement. Enterprise is unjustifiable for a small practice of this size. The Free
edition does not provide the same call capacity as paid keys, so the claim in option D is false and it
cannot serve a 14 SC workload.
Q6: 3CX v20 requires which CPU architecture for both the operating system and the
installation media?
A. 32-bit or 64-bit, selected at install time
B. 64-bit only [CORRECT]
C. ARM64 only, for energy-efficient servers
D. 16-bit compatibility mode for legacy hardware
Correct Answer: B
Rationale: Both Debian 11 and the supported Windows Server platforms must be 64-bit; 3CX v20 is
built and shipped exclusively for 64-bit architecture. There is no 32-bit build, so attempting an install
on 32-bit media fails outright. ARM hosts are not a supported server architecture for the PBX, and
references to 16-bit mode are meaningless on modern server hardware. Administrators must
therefore verify the OS architecture before starting the installer.
Questions and Verified Answers | A Grade 3
, 3CX Basic Certification 2026/2027 Exam Verified Answers Edition
Q7: An administrator prefers Windows because the team's tooling is Microsoft-based and
wants the PBX to remain fully supported. Which Windows platform may run 3CX v20?
A. Windows Server 2019 or newer [CORRECT]
B. Windows Server 2008 R2 with the latest service pack
C. Windows 10 Pro on a desktop PC
D. Windows Small Business Server 2011
Correct Answer: A
Rationale: Windows Server 2019 and newer releases are the supported Windows platforms for v20,
satisfying the administrator's preference for Microsoft tooling. Windows Server 2008 R2 is long out
of support and not validated for v20. Desktop Windows versions and legacy SBS releases are not
server platforms licensed or tested for 3CX. Where feasible, Debian 11 remains the primary
recommendation, but Windows Server 2019+ keeps the deployment supported.
Q8: During the initial configuration of a 3CX install, which two FQDN options can the
administrator choose from?
A. A NetBIOS hostname or a raw IP address
B. A 3CX-managed subdomain or a customer-owned custom FQDN [CORRECT]
C. A dynamic DNS name or a Windows domain controller name
D. An internal split-horizon name or a DHCP option 15 suffix
Correct Answer: B
Rationale: At setup, 3CX offers either a 3CX-managed subdomain such as mypbx.3cx.com, or a
custom FQDN owned by the customer. The managed subdomain comes with DNS hosting and an
automatically provisioned Let's Encrypt certificate, while a custom FQDN requires the customer's
own publicly resolvable DNS record. NetBIOS names, raw IPs and internal-only names are not valid
choices because endpoints must resolve the PBX from anywhere. This choice cannot be treated as a
purely local naming decision.
Q9: A company selects its own domain, pbx.acmecorp.com, during setup and wants
certificate handling to remain maintenance-free. How does 3CX handle the SSL certificate
for this custom FQDN?
A. Custom domains are not allowed; only 3cx.com subdomains can host a PBX
B. An administrator must manually buy and renew a paid wildcard certificate every year
C. 3CX can automatically provision and renew a free Let's Encrypt certificate for
the publicly resolvable FQDN [CORRECT]
D. No certificate is needed because SIP traffic is always encrypted by default
Correct Answer: C
Rationale: For any publicly resolvable custom FQDN, 3CX integrates Let's Encrypt to issue and
automatically renew the certificate, keeping the deployment maintenance-free. Custom domains are
fully supported, so option A misstates the platform. Manual certificate purchases are unnecessary
overhead and not the designed flow. Certificates are essential because provisioning and client traffic
run over HTTPS; SIP itself is not automatically encrypted end to end.
Questions and Verified Answers | A Grade 4
Questions and Verified Answers | A Grade
Latest 2026/2027 Update | Aligned with the 3CX Academy Basic Certification Curriculum (3CX v20) | 100 Questions
with Comprehensive Rationales
Exam Overview
Section Coverage Focus Questions
Section 1: System Fundamentals, Installation and OS Requirements, FQDN, Deployment
Q1 - Q20
Requirements Models, License Types, Virtualization
Section 2: Networking, Firewall and Port Port Requirements, NAT, Firewall
Q21 - Q35
Configuration Rules, SIP ALG, STUN
SIP Protocol, Codecs, SIP Trunk
Section 3: SIP Trunking and VoIP Fundamentals Configuration, Registration, Q36 - Q55
Troubleshooting
Extension Configuration, DIDs,
Section 4: Extension Management and Call Routing Inbound/Outbound Rules, Digital Q56 - Q75
Receptionist, Ring Groups
Section 5: Security, Maintenance and Anti-Hacking, Backup/Restore, Firewall
Q76 - Q85
Troubleshooting Checker, Security Best Practices
Section 6: 3CX Apps, Remote Connectivity and 3CX App Provisioning, Tunnel, SBC,
Q86 - Q100
SBC WebRTC, Web Client
SECTION 1 Questions 1-20
System Fundamentals, Installation and Requirements
Coverage: OS Requirements, FQDN, Deployment Models, License Types, Virtualization
Q1: Before installing and activating a 3CX v20 PBX, which prerequisite ensures that remote
phones, apps and the Let's Encrypt certificate service can all reach the system?
A. A fully qualified domain name (FQDN) that resolves publicly on the internet,
together with proper firewall configuration [CORRECT]
B. A static NetBIOS computer name registered in the local workgroup
C. A Microsoft Active Directory domain joined to the same forest
D. A licensed hardware VPN concentrator placed in front of the server
Correct Answer: A
Rationale: 3CX mandates an FQDN with public DNS resolvability plus correctly configured firewall
ports as installation prerequisites. The FQDN is what phones, apps and the provisioning service use to
Questions and Verified Answers | A Grade 1
,3CX Basic Certification 2026/2027 Exam Verified Answers Edition
reach the PBX, and it is also the name bound into the SSL certificate, so a NetBIOS name or AD
membership cannot substitute. A VPN concentrator is not part of the 3CX architecture and adds no
certificate or provisioning capability. Without a publicly resolvable FQDN, activation and certificate
issuance simply fail.
Q2: Which operating system is the primary supported platform for a fresh 3CX v20
installation?
A. Ubuntu Server 22.04 LTS (64-bit)
B. Debian 11 (64-bit) [CORRECT]
C. CentOS Stream 9 (64-bit)
D. Red Hat Enterprise Linux 8 (64-bit)
Correct Answer: B
Rationale: Debian 11 (64-bit) is the primary, officially blessed platform for v20 installations and
receives the smoothest tested upgrade path. Ubuntu, CentOS Stream and RHEL are not part of the
v20 supported OS list, so installs on them are unsupported even if the script appears to run. Windows
Server 2019 or newer is also supported, but only as a secondary platform. Choosing the primary
platform keeps the installation covered by 3CX support and automated updates.
Q3: A hosting provider wants to deploy dozens of customer PBXs on its existing
virtualization farm. Which set of virtualization platforms is officially supported for running
3CX?
A. VirtualBox, VMware Workstation and Parallels Desktop
B. Docker, LXC and other container runtimes
C. Hyper-V, VMware ESXi, KVM and XenServer (Citrix Hypervisor)
[CORRECT]
D. Only Microsoft Azure VMs of the B-series family
Correct Answer: C
Rationale: 3CX supports the enterprise hypervisors Hyper-V, ESXi, KVM and XenServer, which are
the platforms tested for media timing and performance. Desktop hypervisors such as VirtualBox,
VMware Workstation and Parallels are not supported because their clock and network handling is
unreliable for real-time RTP. Container runtimes like Docker and LXC are likewise unsupported
deployment forms. A cloud provider restriction such as a specific Azure VM family is not a 3CX
support statement.
Questions and Verified Answers | A Grade 2
,3CX Basic Certification 2026/2027 Exam Verified Answers Edition
Q4: A business requires up to 64 simultaneous calls on its PBX. Which 3CX license edition is
the minimum that supports this capacity?
A. Free edition
B. Standard edition (16 simultaneous calls)
C. Pro edition (64 simultaneous calls) [CORRECT]
D. Enterprise edition (unlimited calls only)
Correct Answer: C
Rationale: The Pro edition key is licensed for 64 simultaneous calls (SC), which exactly matches the
stated requirement. The Standard edition is capped at 16 SC, so it would block call setup once the
limit is reached. The Free edition is a small starter key and cannot reach 64 SC either. Enterprise is
positioned above Pro, so Pro is the minimum edition that satisfies the requirement without paying for
Enterprise.
Q5: A growing dental practice measured its busy-hour peak at 14 simultaneous calls and
wants the lowest-cost official edition that still covers that figure. Which license should the
administrator procure?
A. Standard edition, licensed for 16 simultaneous calls [CORRECT]
B. Pro edition, licensed for 64 simultaneous calls
C. Enterprise edition, because only it supports clinics
D. Free edition, since it includes the same call capacity with limited features
Correct Answer: A
Rationale: The Standard edition covers 16 simultaneous calls, which comfortably fits the measured
14-call peak at the lowest cost point. The Pro edition also covers the load but costs more than
necessary for this requirement. Enterprise is unjustifiable for a small practice of this size. The Free
edition does not provide the same call capacity as paid keys, so the claim in option D is false and it
cannot serve a 14 SC workload.
Q6: 3CX v20 requires which CPU architecture for both the operating system and the
installation media?
A. 32-bit or 64-bit, selected at install time
B. 64-bit only [CORRECT]
C. ARM64 only, for energy-efficient servers
D. 16-bit compatibility mode for legacy hardware
Correct Answer: B
Rationale: Both Debian 11 and the supported Windows Server platforms must be 64-bit; 3CX v20 is
built and shipped exclusively for 64-bit architecture. There is no 32-bit build, so attempting an install
on 32-bit media fails outright. ARM hosts are not a supported server architecture for the PBX, and
references to 16-bit mode are meaningless on modern server hardware. Administrators must
therefore verify the OS architecture before starting the installer.
Questions and Verified Answers | A Grade 3
, 3CX Basic Certification 2026/2027 Exam Verified Answers Edition
Q7: An administrator prefers Windows because the team's tooling is Microsoft-based and
wants the PBX to remain fully supported. Which Windows platform may run 3CX v20?
A. Windows Server 2019 or newer [CORRECT]
B. Windows Server 2008 R2 with the latest service pack
C. Windows 10 Pro on a desktop PC
D. Windows Small Business Server 2011
Correct Answer: A
Rationale: Windows Server 2019 and newer releases are the supported Windows platforms for v20,
satisfying the administrator's preference for Microsoft tooling. Windows Server 2008 R2 is long out
of support and not validated for v20. Desktop Windows versions and legacy SBS releases are not
server platforms licensed or tested for 3CX. Where feasible, Debian 11 remains the primary
recommendation, but Windows Server 2019+ keeps the deployment supported.
Q8: During the initial configuration of a 3CX install, which two FQDN options can the
administrator choose from?
A. A NetBIOS hostname or a raw IP address
B. A 3CX-managed subdomain or a customer-owned custom FQDN [CORRECT]
C. A dynamic DNS name or a Windows domain controller name
D. An internal split-horizon name or a DHCP option 15 suffix
Correct Answer: B
Rationale: At setup, 3CX offers either a 3CX-managed subdomain such as mypbx.3cx.com, or a
custom FQDN owned by the customer. The managed subdomain comes with DNS hosting and an
automatically provisioned Let's Encrypt certificate, while a custom FQDN requires the customer's
own publicly resolvable DNS record. NetBIOS names, raw IPs and internal-only names are not valid
choices because endpoints must resolve the PBX from anywhere. This choice cannot be treated as a
purely local naming decision.
Q9: A company selects its own domain, pbx.acmecorp.com, during setup and wants
certificate handling to remain maintenance-free. How does 3CX handle the SSL certificate
for this custom FQDN?
A. Custom domains are not allowed; only 3cx.com subdomains can host a PBX
B. An administrator must manually buy and renew a paid wildcard certificate every year
C. 3CX can automatically provision and renew a free Let's Encrypt certificate for
the publicly resolvable FQDN [CORRECT]
D. No certificate is needed because SIP traffic is always encrypted by default
Correct Answer: C
Rationale: For any publicly resolvable custom FQDN, 3CX integrates Let's Encrypt to issue and
automatically renew the certificate, keeping the deployment maintenance-free. Custom domains are
fully supported, so option A misstates the platform. Manual certificate purchases are unnecessary
overhead and not the designed flow. Certificates are essential because provisioning and client traffic
run over HTTPS; SIP itself is not automatically encrypted end to end.
Questions and Verified Answers | A Grade 4
