EXAM REVIEW FOR 3CX ACADEMY ADVANCED
CERTIFICATION 2026 GRADED A+
1. A multinational company deploys 3CX in a split DNS environment with on-
premises SBCs in three regions. Users report that external WebRTC clients fail to
register after a firewall rule change. Which firewall port must be open for
WebRTC signalling over TLS?
A. 443/TCP
B. 5001/TCP
C. 5090/TCP
D. 5060/TCP
Correct Answer: A
*Explanation: 443/TCP is used for WebRTC over TLS (HTTPS-based signalling).
5001/TCP is the management console, 5090/TCP is secure tunnel signalling for
tunnel clients, and 5060/TCP is unencrypted SIP. WebRTC clients rely on port 443
for secure WebSocket connections.*
2. During an advanced troubleshooting session, you notice that the 3CX Event Log
shows repeated "Call Leg Timeout" errors for external calls routed via a VoIP
provider. The provider requires a specific SIP timer value. Which parameter in
3CX’s advanced SIP settings directly controls the maximum call establishment
time before timeout?
A. T1 Timer (default 500ms)
B. T2 Timer (default 4s)
C. Invite Timeout (default 30s)
D. Ring Timeout (default 60s)
Correct Answer: C
*Explanation: The "Invite Timeout" governs how long 3CX waits for a final
response (e.g., 200 OK or 4xx/5xx) to an INVITE. T1 and T2 are retransmission
timers; Ring Timeout affects user ringing duration. For provider timeouts,
adjusting Invite Timeout is correct.*
,3. A 3CX administrator needs to block all international calls except to a whitelist of
15 country codes, using the advanced outbound rules engine. What is the most
efficient method?
A. Create 15 allow rules for the whitelist codes above a single deny-all
international rule.
B. Create one regular expression deny rule matching all international prefixes,
then exception rules.
C. Configure each extension’s "Outbound Rules" tab to restrict international
calling by group.
D. Use the "Allowed Country Codes" list under SIP Trunks → Advanced →
International Calls.
Correct Answer: A
Explanation: 3CX processes outbound rules in order; placing 15 specific allow rules
(with higher priority) above a general deny rule for international prefixes is the
standard, efficient method. The "Allowed Country Codes" applies to inbound DID
matching, not outbound restrictions. Regex rules are less readable and
maintainable.
4. A financial services customer requires FIPS 140-2 compliant encryption for all SIP
signalling and media. The 3CX instance runs on Windows Server 2022. Which two
configuration changes are mandatory?
A. Enable "Secure SIP (TLS)" on all extensions and enforce "SRTP Only" system-
wide.
B. Replace the default self-signed certificate with an internal CA certificate,
disable RTP.
C. Enable "PBX Delivers Audio" and set "Media Encryption Mode" to "Not
Secure".
D. Set "Minimum TLS Version" to 1.0 and enable "Allow Unencrypted Media".
Correct Answer: A
*Explanation: FIPS 140-2 compliance requires TLS for SIP signalling and SRTP for
media encryption. Enforcing "Secure SIP (TLS)" on extensions and "SRTP Only"
ensures encryption. Disabling RTP or using insecure modes violates FIPS. TLS 1.0
is outdated and non-compliant.*
,5. A 3CX Advanced administrator runs the "3CX ISO Backup and Restore" tool to
migrate from an on-premises Debian 11 server to a new Debian 12 server. After
restoration, extensions register but no audio passes in either direction. What is
the most likely cause?
A. The new server’s IP address differs from the original, but the 3CX firewall check
was not re-run.
B. The backup excluded the "System Prompts" folder, breaking codec negotiation.
C. The license key was deactivated and reactivated, resetting media server
settings.
D. The STUN resolution updated the public IP, but the SBC tunnel port 5090 is
blocked.
Correct Answer: A
Explanation: 3CX embeds the local IP address in SDP messages. After migration to
a new IP, the firewall check must update the media IP binding. Without it, RTP
sends to the old IP, causing no audio. Codec, license, and SBC issues would not
produce this specific symptom.
6. In a 3CX Enterprise deployment with 250 daily active users, you observe high CPU
usage on the Linux server during peak hours. Top shows multiple
"3CXSystemService" processes consuming 85% CPU. Which action most likely
reduces CPU load without degrading call quality?
A. Enable "PBX Delivers Audio" for all internal calls.
B. Disable "Support Re-INVITE" in the SIP trunk settings.
C. Migrate all recording storage to an external S3 bucket.
D. Set "Codec Priority" to favor G.711 over OPUS.
Correct Answer: A
*Explanation: Enabling "PBX Delivers Audio" means the PBX does not relay media
for internal calls, reducing CPU usage for media proxying. External S3 recording
affects disk I/O, not CPU. OPUS is more CPU-intensive, but codec priority changes
alone rarely solve CPU spikes.*
7. A 3CX instance is configured with an IP-based SIP trunk (no registration). The
provider sends a 408 Request Timeout after 15 seconds on outbound calls. Which
log should you inspect first to confirm if 3CX is not sending ACK for the 200 OK?
, A. 3CXCfgServer.log
B. 3CXSystemService.log
C. 3CXCallFlow.log
D. SIPServer.log (Verbose)
Correct Answer: D
*Explanation: The SIPServer.log at verbose level captures all SIP message
exchanges (INVITE, 200 OK, ACK). Missing ACK indicates a transaction timeout.
CallFlow.log shows logical call states but not raw SIP; SystemService/CfgServer
logs are for configuration and services.*
8. You are deploying 3XC on Hyper-V with 4 vCPUs and 8GB RAM for 50
simultaneous calls. After 30 days, users complain of choppy audio during peak
hours. Windows Performance Monitor shows "% Guest OS Processor Time" spikes
to 100% on one vCPU while others are idle. What is the cause?
A. Inadequate network throughput on the virtual switch.
B. 3CX Media Server is single-threaded for RTP mixing.
C. Hyper-V dynamic memory is causing memory pressure.
D. The VM generation is Gen 1 instead of Gen 2.
Correct Answer: B
*Explanation: The 3CX Media Server (core RTP mixing/conferencing) runs as a
single-threaded process on older builds; one vCPU core saturates before others
are used. This matches uneven CPU usage. Dynamic memory affects RAM, not
CPU core distribution.*
9. A company using 3CX Hotel module with premium PMS integration experiences
check-in failures for rooms 100-120. The PMS sends a valid XML request, but 3CX
logs "Guest name contains invalid characters". Which file must be edited to
customize allowed characters for guest names?
A. /var/lib/3cxpbx/Instance1/Data/Http/Interface/hotel_pms_config.xml
B. /var/lib/3cxpbx/Instance1/Data/Http/Interface/api/config.json
C. /var/lib/3cxpbx/Instance1/Bin/hotel_pms_sanitize.conf
D. This is not configurable; guest names must be alphanumeric only.
Correct Answer: C
Explanation: 3CX allows regex sanitization via hotel_pms_sanitize.conf (Linux) or
CERTIFICATION 2026 GRADED A+
1. A multinational company deploys 3CX in a split DNS environment with on-
premises SBCs in three regions. Users report that external WebRTC clients fail to
register after a firewall rule change. Which firewall port must be open for
WebRTC signalling over TLS?
A. 443/TCP
B. 5001/TCP
C. 5090/TCP
D. 5060/TCP
Correct Answer: A
*Explanation: 443/TCP is used for WebRTC over TLS (HTTPS-based signalling).
5001/TCP is the management console, 5090/TCP is secure tunnel signalling for
tunnel clients, and 5060/TCP is unencrypted SIP. WebRTC clients rely on port 443
for secure WebSocket connections.*
2. During an advanced troubleshooting session, you notice that the 3CX Event Log
shows repeated "Call Leg Timeout" errors for external calls routed via a VoIP
provider. The provider requires a specific SIP timer value. Which parameter in
3CX’s advanced SIP settings directly controls the maximum call establishment
time before timeout?
A. T1 Timer (default 500ms)
B. T2 Timer (default 4s)
C. Invite Timeout (default 30s)
D. Ring Timeout (default 60s)
Correct Answer: C
*Explanation: The "Invite Timeout" governs how long 3CX waits for a final
response (e.g., 200 OK or 4xx/5xx) to an INVITE. T1 and T2 are retransmission
timers; Ring Timeout affects user ringing duration. For provider timeouts,
adjusting Invite Timeout is correct.*
,3. A 3CX administrator needs to block all international calls except to a whitelist of
15 country codes, using the advanced outbound rules engine. What is the most
efficient method?
A. Create 15 allow rules for the whitelist codes above a single deny-all
international rule.
B. Create one regular expression deny rule matching all international prefixes,
then exception rules.
C. Configure each extension’s "Outbound Rules" tab to restrict international
calling by group.
D. Use the "Allowed Country Codes" list under SIP Trunks → Advanced →
International Calls.
Correct Answer: A
Explanation: 3CX processes outbound rules in order; placing 15 specific allow rules
(with higher priority) above a general deny rule for international prefixes is the
standard, efficient method. The "Allowed Country Codes" applies to inbound DID
matching, not outbound restrictions. Regex rules are less readable and
maintainable.
4. A financial services customer requires FIPS 140-2 compliant encryption for all SIP
signalling and media. The 3CX instance runs on Windows Server 2022. Which two
configuration changes are mandatory?
A. Enable "Secure SIP (TLS)" on all extensions and enforce "SRTP Only" system-
wide.
B. Replace the default self-signed certificate with an internal CA certificate,
disable RTP.
C. Enable "PBX Delivers Audio" and set "Media Encryption Mode" to "Not
Secure".
D. Set "Minimum TLS Version" to 1.0 and enable "Allow Unencrypted Media".
Correct Answer: A
*Explanation: FIPS 140-2 compliance requires TLS for SIP signalling and SRTP for
media encryption. Enforcing "Secure SIP (TLS)" on extensions and "SRTP Only"
ensures encryption. Disabling RTP or using insecure modes violates FIPS. TLS 1.0
is outdated and non-compliant.*
,5. A 3CX Advanced administrator runs the "3CX ISO Backup and Restore" tool to
migrate from an on-premises Debian 11 server to a new Debian 12 server. After
restoration, extensions register but no audio passes in either direction. What is
the most likely cause?
A. The new server’s IP address differs from the original, but the 3CX firewall check
was not re-run.
B. The backup excluded the "System Prompts" folder, breaking codec negotiation.
C. The license key was deactivated and reactivated, resetting media server
settings.
D. The STUN resolution updated the public IP, but the SBC tunnel port 5090 is
blocked.
Correct Answer: A
Explanation: 3CX embeds the local IP address in SDP messages. After migration to
a new IP, the firewall check must update the media IP binding. Without it, RTP
sends to the old IP, causing no audio. Codec, license, and SBC issues would not
produce this specific symptom.
6. In a 3CX Enterprise deployment with 250 daily active users, you observe high CPU
usage on the Linux server during peak hours. Top shows multiple
"3CXSystemService" processes consuming 85% CPU. Which action most likely
reduces CPU load without degrading call quality?
A. Enable "PBX Delivers Audio" for all internal calls.
B. Disable "Support Re-INVITE" in the SIP trunk settings.
C. Migrate all recording storage to an external S3 bucket.
D. Set "Codec Priority" to favor G.711 over OPUS.
Correct Answer: A
*Explanation: Enabling "PBX Delivers Audio" means the PBX does not relay media
for internal calls, reducing CPU usage for media proxying. External S3 recording
affects disk I/O, not CPU. OPUS is more CPU-intensive, but codec priority changes
alone rarely solve CPU spikes.*
7. A 3CX instance is configured with an IP-based SIP trunk (no registration). The
provider sends a 408 Request Timeout after 15 seconds on outbound calls. Which
log should you inspect first to confirm if 3CX is not sending ACK for the 200 OK?
, A. 3CXCfgServer.log
B. 3CXSystemService.log
C. 3CXCallFlow.log
D. SIPServer.log (Verbose)
Correct Answer: D
*Explanation: The SIPServer.log at verbose level captures all SIP message
exchanges (INVITE, 200 OK, ACK). Missing ACK indicates a transaction timeout.
CallFlow.log shows logical call states but not raw SIP; SystemService/CfgServer
logs are for configuration and services.*
8. You are deploying 3XC on Hyper-V with 4 vCPUs and 8GB RAM for 50
simultaneous calls. After 30 days, users complain of choppy audio during peak
hours. Windows Performance Monitor shows "% Guest OS Processor Time" spikes
to 100% on one vCPU while others are idle. What is the cause?
A. Inadequate network throughput on the virtual switch.
B. 3CX Media Server is single-threaded for RTP mixing.
C. Hyper-V dynamic memory is causing memory pressure.
D. The VM generation is Gen 1 instead of Gen 2.
Correct Answer: B
*Explanation: The 3CX Media Server (core RTP mixing/conferencing) runs as a
single-threaded process on older builds; one vCPU core saturates before others
are used. This matches uneven CPU usage. Dynamic memory affects RAM, not
CPU core distribution.*
9. A company using 3CX Hotel module with premium PMS integration experiences
check-in failures for rooms 100-120. The PMS sends a valid XML request, but 3CX
logs "Guest name contains invalid characters". Which file must be edited to
customize allowed characters for guest names?
A. /var/lib/3cxpbx/Instance1/Data/Http/Interface/hotel_pms_config.xml
B. /var/lib/3cxpbx/Instance1/Data/Http/Interface/api/config.json
C. /var/lib/3cxpbx/Instance1/Bin/hotel_pms_sanitize.conf
D. This is not configurable; guest names must be alphanumeric only.
Correct Answer: C
Explanation: 3CX allows regex sanitization via hotel_pms_sanitize.conf (Linux) or
