MS-721 Question #102: Real Exam Question with Answer & Explanation

Question

You have a Microsoft Teams Phone deployment. You are deploying Direct Routing by using a certified Session Border Controller (SBC). The FQDN of the SBC is sbc1.contoso.com. You are signaling port 5067. You cannot place calls and receive an error message in the Microsoft Teams admin center as shown in the following exhibit. What is a possible cause of the issue?

Options

• ACalling plan licenses are not assigned to users.
• BThe Baltimore or the Digicert root certificates are missing on the SBC.
• CThe Forward P-Asserted Identify (PAI) header is disabled.
• DThe failover timer is set to 0 seconds

Explanation

{"question_number": 4, "correct_answer": "B", "explanation": "Microsoft Teams Direct Routing requires the SBC to trust Microsoft's TLS certificates during the mutual TLS (mTLS) handshake. Microsoft uses certificates chained to specific root Certificate Authorities, including the Baltimore CyberTrust Root and DigiCert Global Root CA. If these root certificates are not installed in the SBC's trusted certificate store, the TLS handshake fails and calls cannot be placed, which is exactly the error shown in the admin center. Calling plan licenses (A) are irrelevant in Direct Routing scenarios. The PAI header (C) affects caller identity but not connectivity. A failover timer of 0 seconds (D) would affect failover behavior, not initial call placement.", "generated_by": "claude-sonnet", "llm_judge_score": 4}

No community discussion yet for this question.