In few words:
Standard implementation uses UDP protocol for SIP and RTP traffic. RTP is responsible for carrying audio. SIP communication carries all information about registration, making and answering calls, caller-ID, call termination, BLF status, etc. This happens on port 5060 normally, while RTP uses ports 9000-9500 typically.
Some phones can use also TCP protocol for SIP, but normally TCP is used when traffic is encrypted, i.e. TLS is used. TLS uses port 5061 normally. Encrypted traffic normally would encrypt also RTP traffic (i.e. Secure RTP or SRTP is used). Encryption is made using installed certificate in 3CX PBX.
3CX phone for Windows may be configured to use encrypted traffic, i.e. TLS and SRTP.
This seems not possible yet for mobile 3CX clients (Android, iOS).