DRAG DROP
You have a server that has Exchange Server 2013 installed.
You plan to deploy Unified Messaging (UM) to all users.
You have two UM IP gateways named GW1 and GW2.
You create, and then associate a new UM dial plan for each IP gateway. The IP gateways are
configured as shown in the following table.
You need to recommend a solution that meets the following security requirements:
All voice traffic received by GW1 must be encrypted.
All voice traffic received by GW2 must be unencrypted.
All signaling traffic to GW1 and GW2 must be encrypted.
Which security settings should you recommend configuring for each dial plan?
To answer, drag the appropriate security setting to the correct UM dial plan in the answer area. Each
security setting may be used once, more than once, or not at all. Additionally, you may need to drag
the split bar between panes or scroll to view content.
Answer: 
In on-premises and hybrid deployments, BY DEFAULT, when you create a UM dial plan, it will communicate in UNSECURED mode, and the CAS and Mailbox servers will send and receive data from VoIP gateways, IP PBXs, and SBCs without using encryption.
—-In Unsecured mode the SIP signaling information is not encrypted!—-
When you configure the dial plan to use SIP SECURED mode, only the SIP signaling traffic will be encrypted, and the RTP media channels will still use TCP, which isn’t encrypted.
When you configure the dial plan to use SECURED mode, both the SIP signaling traffic and the RTP media channels are encrypted.
https://technet.microsoft.com/en-us/library/bb125151(v=exchg.150).aspx