You have a requirement to use secure signaling for SIP endpoints. Which protocol and port combination must be used in the SIP Security Profile?
SIP TLS on port 5061 encrypts signalling between SIP endpoints, satisfying the requirement for secure signalling. TLS protects headers and credentials that plain SIP on 5060 exposes, and 5061 is the registered port for SIP over TLS. The SIP Security Profile in Cisco Unified Communications Manager expects this pairing.
Why this answer
SIP TLS on port 5061 is the standard secure signaling transport for SIP endpoints in Cisco Unified Communications Manager. The SIP Security Profile in CUCM requires selecting TLS as the transport with port 5061 so that SIP signaling is encrypted with certificates between the endpoint and the call agent.
Exam trap
CLCOR often tests the confusion between signaling encryption (SIP TLS/5061) and media encryption (SRTP), causing candidates to pick SRTP as the 'secure signaling' answer.
How to eliminate wrong answers
Option B is wrong because HTTP 443 is used for web/HTTPS management and XML services, not for SIP signaling. Option C is wrong because SIP TCP 5060 is the unencrypted signaling port and provides no confidentiality or integrity for SIP messages. Option D is wrong because SRTP is the media encryption protocol (typically on even-numbered RTP ports), not a signaling protocol, and it does not run on 5061.