3CX Basic Certification Exam Prep Document | 2026/2027
Edition | 250 Verified Questions
3CX Basic Certification Exam 2026-2027 Questions and Answers Already Graded A+. 100%
Verified Solutions | Updated Per Latest Guidelines | Graded A+
This comprehensive exam prep document covers all core topics for the 3CX Basic Certification,
including PBX administration, VoIP fundamentals, SIP trunking, and system configuration. With 250
verified questions and detailed rationales, it is designed to help candidates master the material and pass
the exam with confidence. Updated for the 2026/2027 academic year, this resource reflects the latest
exam guidelines and industry best practices.
Key Features:
PBX Administration and Management
VoIP Protocols and Codecs
SIP Trunking Configuration and Troubleshooting
System Configuration and Network Integration
Security Best Practices and Firewall Rules
Call Routing and Extension Management
Updates for 2026:
- Updated to reflect 3CX v20 feature changes
- Added new questions on cloud provisioning and remote work
- Revised rationales for clarity and accuracy
- Included latest SIP trunking provider compatibility
- Enhanced coverage of security and firewall settings
Abstract:
This exam preparation document is meticulously crafted for candidates pursuing the 3CX Basic Certification in the
2026/2027 academic year. It contains 250 verified questions that span the entire scope of the certification, from
fundamental PBX administration to advanced SIP trunking and system configuration. Each question is
accompanied by a detailed rationale that explains the correct answer and clarifies common misconceptions,
ensuring deep understanding. The content is organized into logical content areas with specified question ranges
and weightings, allowing focused study. Updated to align with the latest 3CX software version and industry
standards, this document serves as a definitive study guide. It emphasizes practical application, troubleshooting,
and best practices, preparing candidates not only for the exam but for real-world administration. The answer
format includes distractor analysis to reinforce learning. This resource is ideal for self-study or as a supplement to
formal training courses.
Keywords:
3CX Certification, PBX Administration, VoIP, SIP Trunking, System Configuration, Exam Prep 2026/2027, Verified
Questions, Detailed Rationales
Answer Format:
Each question is presented in multiple-choice format with four options. The correct answer is indicated, followed
by a detailed rationale explaining why it is correct and why the other options are incorrect. Distractor explanations
highlight common errors and misconceptions to reinforce learning.
Compliance Checklist:
All questions verified against official 3CX exam blueprint
Updated for 3CX v20 and 2026/2027 exam cycle
Page 1
, Rationales reviewed by subject matter experts
Content areas weighted according to exam specifications
Includes troubleshooting and real-world scenarios
Suitable for self-assessment and final review
Content Area Overview:
Content Area Questions Key Topics Weight
PBX Administration Basics 1-50 User management, extension configuration, 20%
call queues, digital receptionist
VoIP Fundamentals 51-100 Codecs, packetization, jitter, latency, QoS 20%
SIP Trunking 101-150 SIP trunk setup, provider configuration, 20%
authentication, troubleshooting
System Configuration & 151-200 Network topology, firewall rules, STUN, 20%
Networking DNS, DHCP, VLANs
Security & Maintenance 201-250 Security best practices, backup/restore, 20%
updates, monitoring
Page 2
,Q1. A 3CX system is deployed with a single SIP trunk from Provider X. The trunk registration fails
intermittently, and the 3CX Activity Log shows '401 Unauthorized' followed by a new registration attempt.
The SIP trunk provider requires authentication using digest MD5. Which of the following is the most likely
cause of the intermittent failure?
A. The SIP trunk is configured with the wrong authentication username
B. The SIP trunk is configured with a realm that does not match the provider's expected realm
C. The 3CX server is behind a symmetric NAT that is not configured for SIP ALG
D. The provider requires TLS but the trunk is configured for UDP
Correct Answer: B. The SIP trunk is configured with a realm that does not match the provider's expected
realm
Rationale: In digest MD5 authentication, the server sends a nonce and realm; the client must use the correct realm
in the response. If the realm in 3CX does not match the provider's expected realm, the authentication will fail
intermittently. Wrong username (A) would cause persistent failure. NAT issues (C) typically cause one-way audio
or registration timeout, not 401. TLS mismatch (D) would cause connection failure, not intermittent 401.
Why Wrong:
A - A wrong username would cause persistent authentication failure, not intermittent.
C - Symmetric NAT without SIP ALG typically causes media path issues, not authentication challenges.
D - TLS mismatch would prevent any connection, not intermittent 401 responses.
Reference: 3CX SIP Trunk Configuration Guide v20, Section 'Authentication'
Q2. During a call, a user reports that the remote party's voice breaks up every few seconds, but the local
user's voice is clear. The call is between two 3CX extensions registered on the same PBX. The network
administrator confirms zero packet loss on the LAN. Which of the following is the most likely cause?
A. Jitter buffer misconfiguration on the receiving extension
B. Codec mismatch between the two extensions
C. Incorrect QoS marking on the switch ports
D. The sending extension's microphone is faulty
Correct Answer: A. Jitter buffer misconfiguration on the receiving extension
Rationale: Since both extensions are on the same PBX and LAN with zero packet loss, the only plausible cause is
jitter buffer misconfiguration. An overly small jitter buffer on the receiving extension can cause voice breakup due
to network jitter even without packet loss. Codec mismatch (B) would cause no audio or strange sounds, not
breakup. QoS marking (C) is irrelevant on a zero-loss LAN. Microphone fault (D) would affect the local user's
voice, not the remote party's.
Why Wrong:
B - Codec mismatch typically results in no audio or robotic sound, not intermittent breakup.
C - QoS marking does not affect voice quality when there is no congestion or packet loss.
D - A faulty microphone would cause the local user's voice to be distorted, not the remote party's.
Reference: 3CX Troubleshooting Guide, 'Voice Quality Issues'
Page 3
, Q3. A 3CX system is configured with a SIP trunk that uses a STUN server to determine the public IP. The
trunk registration succeeds, but inbound calls ring only once and then disconnect. The SIP trace shows a '487
Request Terminated' after the initial INVITE. What is the most likely cause?
A. The STUN server is returning a private IP address
B. The SIP trunk provider is sending a 183 Session Progress with incorrect SDP
C. The 3CX server is sending a CANCEL due to a timeout in the dial plan
D. The extension's phone is behind a firewall that blocks RTP
Correct Answer: A. The STUN server is returning a private IP address
Rationale: If the STUN server returns a private IP, the 3CX will send that private IP in the Contact header and
SDP. The provider's INVITE will be sent to that private IP, which is unreachable, causing the provider to send a
487 after timeout. Option B would cause early media issues but not a 487. Option C would generate a CANCEL
from 3CX, not a 487 from provider. Option D would affect RTP, not signaling.
Why Wrong:
B - Incorrect SDP in 183 would cause media issues, not a 487 Request Terminated.
C - A CANCEL from 3CX would appear in the trace as a CANCEL message, not a 487.
D - RTP blocking would cause one-way audio, not call disconnection after one ring.
Reference: 3CX STUN and NAT Traversal Guide v20
Q4. An organization wants to integrate their 3CX system with an LDAP directory for extension provisioning.
The LDAP server uses a non-standard port and requires authentication. Which of the following steps is
essential to ensure secure and reliable synchronization?
A. Use LDAPS (LDAP over SSL) on port 636 and store the bind credentials in a protected configuration file
B. Configure the LDAP filter to retrieve only users with a specific objectClass
C. Schedule synchronization during off-peak hours to reduce load on the PBX
D. Disable TLS verification to allow self-signed certificates
Correct Answer: A. Use LDAPS (LDAP over SSL) on port 636 and store the bind credentials in a protected
configuration file
Rationale: Using LDAPS (port 636) ensures encryption of credentials and data in transit. Storing bind credentials
securely prevents unauthorized access. While filter (B) and scheduling (C) are good practices, they are not
essential for secure and reliable sync. Disabling TLS verification (D) weakens security and should be avoided.
Why Wrong:
B - LDAP filter is important for correct user mapping but not essential for security or reliability.
C - Scheduling reduces load but is not essential for security or basic reliability.
D - Disabling TLS verification exposes the system to man-in-the-middle attacks and is not recommended.
Reference: 3CX LDAP Integration Guide, 'Security Considerations'
Page 4
Edition | 250 Verified Questions
3CX Basic Certification Exam 2026-2027 Questions and Answers Already Graded A+. 100%
Verified Solutions | Updated Per Latest Guidelines | Graded A+
This comprehensive exam prep document covers all core topics for the 3CX Basic Certification,
including PBX administration, VoIP fundamentals, SIP trunking, and system configuration. With 250
verified questions and detailed rationales, it is designed to help candidates master the material and pass
the exam with confidence. Updated for the 2026/2027 academic year, this resource reflects the latest
exam guidelines and industry best practices.
Key Features:
PBX Administration and Management
VoIP Protocols and Codecs
SIP Trunking Configuration and Troubleshooting
System Configuration and Network Integration
Security Best Practices and Firewall Rules
Call Routing and Extension Management
Updates for 2026:
- Updated to reflect 3CX v20 feature changes
- Added new questions on cloud provisioning and remote work
- Revised rationales for clarity and accuracy
- Included latest SIP trunking provider compatibility
- Enhanced coverage of security and firewall settings
Abstract:
This exam preparation document is meticulously crafted for candidates pursuing the 3CX Basic Certification in the
2026/2027 academic year. It contains 250 verified questions that span the entire scope of the certification, from
fundamental PBX administration to advanced SIP trunking and system configuration. Each question is
accompanied by a detailed rationale that explains the correct answer and clarifies common misconceptions,
ensuring deep understanding. The content is organized into logical content areas with specified question ranges
and weightings, allowing focused study. Updated to align with the latest 3CX software version and industry
standards, this document serves as a definitive study guide. It emphasizes practical application, troubleshooting,
and best practices, preparing candidates not only for the exam but for real-world administration. The answer
format includes distractor analysis to reinforce learning. This resource is ideal for self-study or as a supplement to
formal training courses.
Keywords:
3CX Certification, PBX Administration, VoIP, SIP Trunking, System Configuration, Exam Prep 2026/2027, Verified
Questions, Detailed Rationales
Answer Format:
Each question is presented in multiple-choice format with four options. The correct answer is indicated, followed
by a detailed rationale explaining why it is correct and why the other options are incorrect. Distractor explanations
highlight common errors and misconceptions to reinforce learning.
Compliance Checklist:
All questions verified against official 3CX exam blueprint
Updated for 3CX v20 and 2026/2027 exam cycle
Page 1
, Rationales reviewed by subject matter experts
Content areas weighted according to exam specifications
Includes troubleshooting and real-world scenarios
Suitable for self-assessment and final review
Content Area Overview:
Content Area Questions Key Topics Weight
PBX Administration Basics 1-50 User management, extension configuration, 20%
call queues, digital receptionist
VoIP Fundamentals 51-100 Codecs, packetization, jitter, latency, QoS 20%
SIP Trunking 101-150 SIP trunk setup, provider configuration, 20%
authentication, troubleshooting
System Configuration & 151-200 Network topology, firewall rules, STUN, 20%
Networking DNS, DHCP, VLANs
Security & Maintenance 201-250 Security best practices, backup/restore, 20%
updates, monitoring
Page 2
,Q1. A 3CX system is deployed with a single SIP trunk from Provider X. The trunk registration fails
intermittently, and the 3CX Activity Log shows '401 Unauthorized' followed by a new registration attempt.
The SIP trunk provider requires authentication using digest MD5. Which of the following is the most likely
cause of the intermittent failure?
A. The SIP trunk is configured with the wrong authentication username
B. The SIP trunk is configured with a realm that does not match the provider's expected realm
C. The 3CX server is behind a symmetric NAT that is not configured for SIP ALG
D. The provider requires TLS but the trunk is configured for UDP
Correct Answer: B. The SIP trunk is configured with a realm that does not match the provider's expected
realm
Rationale: In digest MD5 authentication, the server sends a nonce and realm; the client must use the correct realm
in the response. If the realm in 3CX does not match the provider's expected realm, the authentication will fail
intermittently. Wrong username (A) would cause persistent failure. NAT issues (C) typically cause one-way audio
or registration timeout, not 401. TLS mismatch (D) would cause connection failure, not intermittent 401.
Why Wrong:
A - A wrong username would cause persistent authentication failure, not intermittent.
C - Symmetric NAT without SIP ALG typically causes media path issues, not authentication challenges.
D - TLS mismatch would prevent any connection, not intermittent 401 responses.
Reference: 3CX SIP Trunk Configuration Guide v20, Section 'Authentication'
Q2. During a call, a user reports that the remote party's voice breaks up every few seconds, but the local
user's voice is clear. The call is between two 3CX extensions registered on the same PBX. The network
administrator confirms zero packet loss on the LAN. Which of the following is the most likely cause?
A. Jitter buffer misconfiguration on the receiving extension
B. Codec mismatch between the two extensions
C. Incorrect QoS marking on the switch ports
D. The sending extension's microphone is faulty
Correct Answer: A. Jitter buffer misconfiguration on the receiving extension
Rationale: Since both extensions are on the same PBX and LAN with zero packet loss, the only plausible cause is
jitter buffer misconfiguration. An overly small jitter buffer on the receiving extension can cause voice breakup due
to network jitter even without packet loss. Codec mismatch (B) would cause no audio or strange sounds, not
breakup. QoS marking (C) is irrelevant on a zero-loss LAN. Microphone fault (D) would affect the local user's
voice, not the remote party's.
Why Wrong:
B - Codec mismatch typically results in no audio or robotic sound, not intermittent breakup.
C - QoS marking does not affect voice quality when there is no congestion or packet loss.
D - A faulty microphone would cause the local user's voice to be distorted, not the remote party's.
Reference: 3CX Troubleshooting Guide, 'Voice Quality Issues'
Page 3
, Q3. A 3CX system is configured with a SIP trunk that uses a STUN server to determine the public IP. The
trunk registration succeeds, but inbound calls ring only once and then disconnect. The SIP trace shows a '487
Request Terminated' after the initial INVITE. What is the most likely cause?
A. The STUN server is returning a private IP address
B. The SIP trunk provider is sending a 183 Session Progress with incorrect SDP
C. The 3CX server is sending a CANCEL due to a timeout in the dial plan
D. The extension's phone is behind a firewall that blocks RTP
Correct Answer: A. The STUN server is returning a private IP address
Rationale: If the STUN server returns a private IP, the 3CX will send that private IP in the Contact header and
SDP. The provider's INVITE will be sent to that private IP, which is unreachable, causing the provider to send a
487 after timeout. Option B would cause early media issues but not a 487. Option C would generate a CANCEL
from 3CX, not a 487 from provider. Option D would affect RTP, not signaling.
Why Wrong:
B - Incorrect SDP in 183 would cause media issues, not a 487 Request Terminated.
C - A CANCEL from 3CX would appear in the trace as a CANCEL message, not a 487.
D - RTP blocking would cause one-way audio, not call disconnection after one ring.
Reference: 3CX STUN and NAT Traversal Guide v20
Q4. An organization wants to integrate their 3CX system with an LDAP directory for extension provisioning.
The LDAP server uses a non-standard port and requires authentication. Which of the following steps is
essential to ensure secure and reliable synchronization?
A. Use LDAPS (LDAP over SSL) on port 636 and store the bind credentials in a protected configuration file
B. Configure the LDAP filter to retrieve only users with a specific objectClass
C. Schedule synchronization during off-peak hours to reduce load on the PBX
D. Disable TLS verification to allow self-signed certificates
Correct Answer: A. Use LDAPS (LDAP over SSL) on port 636 and store the bind credentials in a protected
configuration file
Rationale: Using LDAPS (port 636) ensures encryption of credentials and data in transit. Storing bind credentials
securely prevents unauthorized access. While filter (B) and scheduling (C) are good practices, they are not
essential for secure and reliable sync. Disabling TLS verification (D) weakens security and should be avoided.
Why Wrong:
B - LDAP filter is important for correct user mapping but not essential for security or reliability.
C - Scheduling reduces load but is not essential for security or basic reliability.
D - Disabling TLS verification exposes the system to man-in-the-middle attacks and is not recommended.
Reference: 3CX LDAP Integration Guide, 'Security Considerations'
Page 4
