Question: In a 5G network, what is the requirement for TLS certificates used between a Security Edge Protection Proxy (SEPP) and other Network Functions (NFs)/Service Communication Proxy (SCPs)/SEPPs within the same operator domain, regarding their signing authority?
Option 1: They must be self-signed by the SEPP itself to ensure uniqueness.
Option 2: They shall be directly signed by the root Certificate Authority (CA) or an intermediate CA with a valid chain up to this root CA in the operator's domain.
Option 3: They can be signed by any external CA, as long as the certificate is not expired.
Option 4: They are not required to be signed by a CA; a simple encryption key exchange is sufficient.
Explanation: This correct answer reflects the importance of maintaining a trusted and secure environment within an operator's domain. By requiring TLS certificates to be directly signed by the root CA or an intermediate CA with a valid chain, the network ensures that all NFs/SCPs/SEPPs can trust each other's identities, thereby securing internal communications.