N10-009 Question 87
Single answerSIP: 5060/5061A company is migrating from a legacy VoIP deployment to a new hosted IP telephony service. After the cutover, users can place calls only when they are in the main office. Remote users connected through a hotel or public Wi-Fi network report that the softphone shows "registration failed" unless they disable the provider's requirement for encrypted signaling. The network administrator reviews the firewall logs and notices that outbound TCP 5061 is being blocked on some guest networks, while TCP/UDP 5060 is allowed. Which action is the BEST way to restore secure remote softphone registration while following standard SIP port usage?
- A
Configure the softphones to use SIP over TLS on port 5061 and ensure outbound TCP 5061 is permitted
- B
Change the softphones to use unsecured SIP on port 5061 because 5061 is the default port for standard SIP
- C
Allow only UDP 5060 because SIP signaling is encrypted by default on that port
- D
Move SIP registration to port 443 because all SIP clients automatically use HTTPS for signaling
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use SIP over TLS on TCP 5061 and ensure that port is allowed outbound. In standard VoIP deployments, SIP signaling commonly uses port 5060 for unencrypted SIP and port 5061 for SIP secured with TLS. Because the provider requires encrypted signaling, allowing TCP 5061 is the proper fix. This is a practical troubleshooting scenario: users on restrictive guest networks may be able to reach 5060 but fail on 5061, causing secure registration to break. Network+ candidates should recognize the operational difference between SIP on 5060 and secure SIP on 5061 and apply it to firewall and remote-access troubleshooting. Common vendor and industry documentation for SIP deployments consistently identifies 5060 for SIP and 5061 for SIP over TLS; implementation details can vary, but these are the standard ports expected for exam objectives and real-world baseline configuration.
- A. Correct.
Correct. Port 5061 is the commonly used port for SIP over TLS, which provides encrypted SIP signaling. If the hosted provider requires encrypted signaling, remote users will need TCP 5061 reachable to register successfully. This aligns with standard SIP usage: 5060 is commonly used for SIP without TLS, while 5061 is commonly used for SIP with TLS.
- B. Incorrect.
Incorrect. This reverses the port purpose. Port 5061 is associated with SIP over TLS, not unsecured standard SIP. Using unsecured SIP on 5061 would not match normal service expectations and would not satisfy a provider requirement for encrypted signaling.
- C. Incorrect.
Incorrect. Port 5060 is commonly used for SIP signaling without TLS, over UDP or TCP depending on implementation. SIP signaling on 5060 is not encrypted by default. Someone might choose this if they confuse SIP signaling with secure media or assume all modern VoIP signaling is encrypted automatically.
- D. Incorrect.
Incorrect. Although some applications can traverse firewalls using alternative methods or session border controller features, SIP clients do not automatically switch to HTTPS on port 443 for standard SIP signaling. HTTPS and SIP are different protocols. This option reflects a common misconception that any encrypted application traffic can simply be moved to 443 without specific support from both client and provider.