When should the security appliance force remote IP phones connecting to the phone proxy through the internet to be in secured mode?

A Cisco ASA is configured for TLS proxy. When should the security appliance force remote IP
phones connecting to the phone proxy through the internet to be in secured mode?

A.
When the Cisco Unified Communications Manager cluster is in non-secure mode

B.
When the Cisco Unified Communications Manager cluster is in secure mode only

C.
When the Cisco Unified Communications Manager is not part of a cluster

D.
When the Cisco ASA is configured for IPSec VPN