If the IP Trunk Group (IPTG) authentication is configured for both ingress sipTrunkGroup and ingress IP Peer, the IP Peer configuration will take precedence.
If you wish to use the intChallengeResponse and incInternalCredentials flags solely on the sipTrunkGroup level, the IP addresses of the IP Peers from which the SBC receives SIP messages must not match any IP address of the configured IP peers in the ingress signaling zone. If the source IP address of received SIP messages matches the IP address of any IP Peer in the signaling zone, the intChallengeResponse and incInternalCredentials flags on the ipPeer level will take precedence.