The best mitigation practice for man-in-the-middle (MITM) Voice over Internet Protocol (VoIP) attacks is to use Transport Layer Security (TLS) protocol. TLS is a protocol that provides secure and encrypted communication and connection between two systems or devices over an unsecured or public network, such as the internet. TLS can mitigate MITM VoIP attacks, because it can:

Verify and authenticate the identity and the validity of the systems or devices that are involved in the VoIP communication or connection, by using the digital certificates and the public keys, and prevent any impersonation, spoofing, or repudiation of the VoIP communication or connection.

Encrypt and decrypt the data or the information that are exchanged in the VoIP communication or connection, by using the public keys and the private keys, and prevent any interception, modification, or eavesdropping of the VoIP communication or connection.

Sign and verify the data or the information that are exchanged in the VoIP communication or connection, by using the digital signatures and the public keys, and ensure that the VoIP communication or connection are not altered, corrupted, or tampered with.

The other options are not the best mitigation practices for MITM VoIP attacks. Media Gateway Control Protocol (MGCP) is a protocol that provides the control and the management of the media gateways or the devices that convert the voice or the audio signals from one format or network to another format or network, such as from analog to digital, or from circuit-switched to packet-switched. MGCP does not mitigate MITM VoIP attacks, but rather facilitates the VoIP communication or connection, and it does not provide any security or encryption features or mechanisms. File Transfer Protocol (FTP) is a protocol that provides the transfer or the exchange of the files or the data between two systems or devices over a network, such as the internet. FTP does not mitigate MITM VoIP attacks, but rather supports the VoIP communication or connection, and it does not provide any security or encryption features or mechanisms. Secure Shell (SSH) is a protocol that provides secure and encrypted communication and connection between two systems or devices over an unsecured or public network, such as the internet. SSH can mitigate MITM VoIP attacks, but it is not the best option, because it is not designed or optimized for the VoIP communication or connection, and it may have some limitations or challenges, such as the bandwidth, the latency, or the compatibility of the protocol. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 5: Communication and Network Security, page 589. Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 5: Communication and Network Security, page 590.