Which CUCM component enforces encryption policy across calls?

• A. RBAC
• B. TLS Policy
• C. Security Profile
• D. ACL

Answer: (C)

In CUCM, encryption decisions for calls are enforced where the call path is defined: the Security Profile. This profile specifies whether signaling is encrypted (TLS) and whether media is encrypted (SRTP). When a call is set up, CUCM applies the Security Profiles of the involved endpoints/trunks and negotiates encryption accordingly. If both ends are configured to use TLS for signaling and SRTP for media, the call proceeds with encryption; if not, encryption may not be used.

RBAC controls who can change settings, not whether calls are encrypted. An ACL governs which networks or devices can access resources, not the encryption policy itself. The TLS Policy handles broader TLS usage rules, but the actual per-call enforcement comes from the Security Profile attached to the devices/trunks involved in the call.