Question: Under what circumstances may an SgNB request a Master eNodeB (MeNB) to update the Secondary Key for eNodeB (S-KgNB) over the X2-C interface?
Option 1: When the MeNB's AS security context is initialized for the first time.
Option 2: Upon completion of every X2-handover procedure.
Option 3: When uplink or downlink PDCP COUNTs are about to wrap around for any SgNB-terminated DRBs (Data Radio Bearers) or SRBs (Signaling Radio Bearers).
Option 4: If the MeNB's currently active KeNB is re-keyed due to a change in the network's security policy.
Explanation: This option is correct because, according to the specified telecom security architecture, an SgNB (Secondary gNodeB) is required to request an update of the S-KgNB from the MeNB (Master eNodeB) over the X2-C interface specifically when there's a risk of PDCP COUNT wrap-around for any of its terminated DRBs or SRBs. This ensures continuous secure data transmission and signaling, maintaining the integrity of the two-hop security property during handovers.