1
3CX Academy Advanced Certification
Exam 2026/2027 Actual Exam with
Detailed Verified Answers | Already
Graded A+
Domain 1: Advanced System Configuration & Network Integration (Questions 1-20)
Q1: When configuring a 3CX system for a multi-site deployment with a centralized SIP trunk,
which setup correctly minimizes bandwidth usage between sites for internal calls?
A. Configure a separate SIP trunk at each branch site.
B. Use the "Bridge" feature to enable direct SIP between extensions at different sites.
C. Route all internal calls through the central site's SIP trunk provider.
D. Disable audio codec negotiation.
Answer: B
Verified Solution & Rationale: The 3CX Bridge feature creates a direct SIP tunnel between PBXs
so internal calls stay on-net, bypassing the provider trunk and saving bandwidth.
Q2: To prioritize VoIP traffic on a network where 3CX is deployed, the recommended DSCP
value for RTP (media) traffic is:
A. CS0 (0)
B. EF (46)
C. AF41 (34)
D. CS7 (56)
Answer: B
Verified Solution & Rationale: DSCP EF (46) is the official 3CX and IETF recommendation for
RTP voice media to receive strict priority queuing.
Q3: A 3CX V20 PBX is behind a NAT firewall that does not support SIP ALG; which
combination prevents one-way audio on remote extensions?
A. Enable STUN on every extension and open UDP 5060 only.
B. Set the trunk to use “External IP” in STUN settings and open UDP 9000-10999 for RTP.
,2
C. Disable STUN and forward TCP 5060 to the PBX.
D. Enable SIP ALG on the firewall and open all high UDP ports.
Answer: B
Verified Solution & Rationale: Entering the public IP in the 3CX Management Console →
Network → STUN and opening the default RTP range UDP 9000-10999 ensures symmetric NAT
traversal without SIP ALG.
Q4: When integrating 3CX with an existing VLAN-based voice network, the recommended
voice VLAN configuration is:
A. Use the native VLAN for both voice and data to reduce complexity.
B. Tag the voice VLAN on the 3CX NIC and set the switch port to trunk with voice VLAN 10 as
tagged.
C. Set the 3CX NIC to untagged and let the phones add VLAN tags.
D. Disable VLANs and rely on subnet-based QoS.
Answer: B
Verified Solution & Rationale: 3CX supports 802.1Q tagging; configuring the NIC with the
voice VLAN ID and trunking the switch port keeps voice traffic isolated and prioritized.
Q5: In a Bridge configuration between HQ and Branch, which port must be reachable on the
remote 3CX for the tunnel to establish?
A. TCP 443
B. TCP 5015
C. UDP 5060
D. TCP 5485
Answer: D
Verified Solution & Rationale: The 3CX Bridge service listens on TCP 5485 for provisioning and
tunnel control packets between paired PBXs.
Q6: To secure SIP signaling over the public Internet, 3CX V20 enables TLS by default on which
port?
A. TCP 5060
B. TCP 5061
C. UDP 5060
D. TCP 443
Answer: B
Verified Solution & Rationale: 3CX uses TCP 5061 for SIP-TLS as per RFC 3261 standard,
ensuring encrypted signaling.
Q7: A company requires that internal calls between two sites use G.729 while external calls use
G.711; where is this best enforced?
, 3
A. Set G.729 as the only codec on every extension.
B. Configure codec priorities per bridge and per trunk in “Codec Priority” tabs.
C. Disable G.711 globally.
D. Use a different extension range for each site.
Answer: B
Verified Solution & Rationale: 3CX allows granular codec ordering per bridge (site-to-site) and
per trunk (provider), enabling G.729 for inter-site and G.711 for external calls.
Q8: Which QoS mechanism should be enabled on a Layer-3 switch to honor DSCP markings
from 3CX?
A. Weighted Fair Queuing with IP precedence trust.
B. MQC policy-map using “trust dscp” on ingress.
C. Disable QoS to avoid re-marking.
D. Shape all traffic to 100 Mbps.
Answer: B
Verified Solution & Rationale: A policy-map that trusts DSCP on ingress preserves the EF/AF41
markings set by 3CX, ensuring end-to-end priority.
Q9: To reduce SIP OPTIONS polling on a high-latency satellite link, which trunk parameter
should be adjusted?
A. Set “Qualify=0” to disable OPTIONS.
B. Lower “Registration Timeout” to 60 s.
C. Enable “Use Short Tags”.
D. Increase “Max Concurrent Calls”.
Answer: A
Verified Solution & Rationale: Setting Qualify=0 stops the PBX from sending SIP OPTIONS,
cutting unnecessary traffic on bandwidth-constrained links.
Q10: A customer needs to restrict extension 200 from calling international numbers; the most
scalable method is:
A. Create a separate trunk for ext 200 and block international on the provider side.
B. Use Outbound Rules with “Extension Route” filter denying 00 patterns for ext 200.
C. Disable the trunk for ext 200.
D. Remove the country code from the dial plan.
Answer: B
Verified Solution & Rationale: Outbound Rules support extension-based filters, allowing
granular call barring without extra trunks.
Q11: When deploying 3CX in a DMZ, which interface should be selected in the Management
Console to ensure proper NAT handling?
3CX Academy Advanced Certification
Exam 2026/2027 Actual Exam with
Detailed Verified Answers | Already
Graded A+
Domain 1: Advanced System Configuration & Network Integration (Questions 1-20)
Q1: When configuring a 3CX system for a multi-site deployment with a centralized SIP trunk,
which setup correctly minimizes bandwidth usage between sites for internal calls?
A. Configure a separate SIP trunk at each branch site.
B. Use the "Bridge" feature to enable direct SIP between extensions at different sites.
C. Route all internal calls through the central site's SIP trunk provider.
D. Disable audio codec negotiation.
Answer: B
Verified Solution & Rationale: The 3CX Bridge feature creates a direct SIP tunnel between PBXs
so internal calls stay on-net, bypassing the provider trunk and saving bandwidth.
Q2: To prioritize VoIP traffic on a network where 3CX is deployed, the recommended DSCP
value for RTP (media) traffic is:
A. CS0 (0)
B. EF (46)
C. AF41 (34)
D. CS7 (56)
Answer: B
Verified Solution & Rationale: DSCP EF (46) is the official 3CX and IETF recommendation for
RTP voice media to receive strict priority queuing.
Q3: A 3CX V20 PBX is behind a NAT firewall that does not support SIP ALG; which
combination prevents one-way audio on remote extensions?
A. Enable STUN on every extension and open UDP 5060 only.
B. Set the trunk to use “External IP” in STUN settings and open UDP 9000-10999 for RTP.
,2
C. Disable STUN and forward TCP 5060 to the PBX.
D. Enable SIP ALG on the firewall and open all high UDP ports.
Answer: B
Verified Solution & Rationale: Entering the public IP in the 3CX Management Console →
Network → STUN and opening the default RTP range UDP 9000-10999 ensures symmetric NAT
traversal without SIP ALG.
Q4: When integrating 3CX with an existing VLAN-based voice network, the recommended
voice VLAN configuration is:
A. Use the native VLAN for both voice and data to reduce complexity.
B. Tag the voice VLAN on the 3CX NIC and set the switch port to trunk with voice VLAN 10 as
tagged.
C. Set the 3CX NIC to untagged and let the phones add VLAN tags.
D. Disable VLANs and rely on subnet-based QoS.
Answer: B
Verified Solution & Rationale: 3CX supports 802.1Q tagging; configuring the NIC with the
voice VLAN ID and trunking the switch port keeps voice traffic isolated and prioritized.
Q5: In a Bridge configuration between HQ and Branch, which port must be reachable on the
remote 3CX for the tunnel to establish?
A. TCP 443
B. TCP 5015
C. UDP 5060
D. TCP 5485
Answer: D
Verified Solution & Rationale: The 3CX Bridge service listens on TCP 5485 for provisioning and
tunnel control packets between paired PBXs.
Q6: To secure SIP signaling over the public Internet, 3CX V20 enables TLS by default on which
port?
A. TCP 5060
B. TCP 5061
C. UDP 5060
D. TCP 443
Answer: B
Verified Solution & Rationale: 3CX uses TCP 5061 for SIP-TLS as per RFC 3261 standard,
ensuring encrypted signaling.
Q7: A company requires that internal calls between two sites use G.729 while external calls use
G.711; where is this best enforced?
, 3
A. Set G.729 as the only codec on every extension.
B. Configure codec priorities per bridge and per trunk in “Codec Priority” tabs.
C. Disable G.711 globally.
D. Use a different extension range for each site.
Answer: B
Verified Solution & Rationale: 3CX allows granular codec ordering per bridge (site-to-site) and
per trunk (provider), enabling G.729 for inter-site and G.711 for external calls.
Q8: Which QoS mechanism should be enabled on a Layer-3 switch to honor DSCP markings
from 3CX?
A. Weighted Fair Queuing with IP precedence trust.
B. MQC policy-map using “trust dscp” on ingress.
C. Disable QoS to avoid re-marking.
D. Shape all traffic to 100 Mbps.
Answer: B
Verified Solution & Rationale: A policy-map that trusts DSCP on ingress preserves the EF/AF41
markings set by 3CX, ensuring end-to-end priority.
Q9: To reduce SIP OPTIONS polling on a high-latency satellite link, which trunk parameter
should be adjusted?
A. Set “Qualify=0” to disable OPTIONS.
B. Lower “Registration Timeout” to 60 s.
C. Enable “Use Short Tags”.
D. Increase “Max Concurrent Calls”.
Answer: A
Verified Solution & Rationale: Setting Qualify=0 stops the PBX from sending SIP OPTIONS,
cutting unnecessary traffic on bandwidth-constrained links.
Q10: A customer needs to restrict extension 200 from calling international numbers; the most
scalable method is:
A. Create a separate trunk for ext 200 and block international on the provider side.
B. Use Outbound Rules with “Extension Route” filter denying 00 patterns for ext 200.
C. Disable the trunk for ext 200.
D. Remove the country code from the dial plan.
Answer: B
Verified Solution & Rationale: Outbound Rules support extension-based filters, allowing
granular call barring without extra trunks.
Q11: When deploying 3CX in a DMZ, which interface should be selected in the Management
Console to ensure proper NAT handling?
