N10-009 Question 86
Single answerSIP: 5060/5061A company migrates its VoIP system to a new SIP provider. After the change, users can place calls internally, but remote employees using softphones on the Internet cannot register when the softphone is configured for secure SIP. The firewall team confirms that UDP 5060 is currently allowed to the PBX, but no other SIP-related ports are open. Which action is the BEST next step to restore secure SIP registrations for the remote users?
- A
Allow TCP 5061 from the Internet to the PBX
- B
Allow UDP 161 from the Internet to the PBX
- C
Allow TCP 443 from the Internet to the PBX
- D
Allow UDP 69 from the Internet to the PBX
Show answer and explanation
Correct answer: A
Explanation
This question tests applied knowledge of SIP signaling ports in a real firewall troubleshooting scenario. In standard deployments, SIP signaling uses port 5060 for unencrypted traffic and port 5061 for encrypted signaling, typically SIP over TLS. Because the softphones are configured for secure SIP and only UDP 5060 is currently permitted, remote registration attempts will fail if TCP 5061 is blocked. Network+ candidates should recognize the difference between signaling ports and other services sometimes seen in voice environments, such as TFTP for provisioning or SNMP for monitoring. Best practice is to verify the provider's documentation, PBX vendor guidance, and firewall policy, since some implementations may use alternate ports or require additional media ports for RTP; however, for secure SIP registration specifically, 5061 is the key standard port.
- A. Correct.
Correct. SIP commonly uses port 5060 for unsecured signaling and port 5061 for secure SIP signaling, typically SIP over TLS. If remote softphones are explicitly configured for secure SIP, the PBX or session border device must be reachable on TCP 5061 unless the vendor uses a different documented port. Opening TCP 5061 is the most direct and appropriate next step based on the scenario.
- B. Incorrect.
Incorrect. UDP 161 is used for SNMP, which is for network monitoring and management, not SIP registration. Someone might pick this if they confuse general network device communication with VoIP signaling, but it will not restore secure SIP registrations.
- C. Incorrect.
Incorrect. TCP 443 is commonly used for HTTPS web traffic. Some vendors may tunnel services through 443, but standard secure SIP signaling is not normally restored by simply opening 443 unless the provider specifically documents that design. The scenario points to secure SIP, making 5061 the best answer.
- D. Incorrect.
Incorrect. UDP 69 is used for TFTP, often associated with phone configuration or firmware distribution in some VoIP environments. However, TFTP is not used for secure SIP registration. This is a plausible distractor because TFTP appears in telephony deployments, but it does not address the registration failure described.