Question: When protecting GTP-C messages traversing inter-security domain boundaries, what is the mandatory requirement for IPsec ESP usage?
Option 1: Encryption only, with integrity protection optional
Option 2: Integrity protection only, with encryption optional
Option 3: Either encryption or integrity protection, as chosen by the operator
Option 4: Both encryption and integrity protection must be used
Explanation: To ensure comprehensive security for GTP-C messages crossing between different security domains, using IPsec ESP with both encryption (to protect message content) and integrity protection (to verify message authenticity and detect tampering) is crucial. This dual-layered approach safeguards against a wide range of potential threats.