Question: When does the UE start ciphering and deciphering of NAS messages?
Option 1: Immediately after establishing a new N1 NAS signalling connection
Option 2: After the secure exchange of NAS messages has been established for an N1 NAS signalling connection
Option 3: Only when the AMF indicates the use of a non-null ciphering algorithm in the 5G NAS security context
Option 4: Never, as ciphering is only applied by the AMF
Explanation: According to the specification, the UE starts ciphering and deciphering of NAS messages when the secure exchange of NAS messages has been established for an N1 NAS signalling connection. This ensures that all subsequent NAS messages are sent ciphered until the N1 NAS signalling connection is released or the UE performs inter-system change to S1 mode.