Question: Which of the following EMM messages are accepted by the UE without integrity protection?
Option 1: ATTACH ACCEPT and DETACH REJECT
Option 2: IDENTITY REQUEST (if requested identification parameter is IMSI), AUTHENTICATION REQUEST, AUTHENTICATION REJECT, ATTACH REJECT (if the EMM cause is not #25 or #78), DETACH ACCEPT (for non switch off), TRACKING AREA UPDATE REJECT (if the EMM cause is not #25 or #78), and SERVICE REJECT (if the EMM cause is not #25 or #78)
Option 3: SECURITY MODE COMMAND and ATTACH REJECT
Option 4: DETACH ACCEPT and TRACKING AREA UPDATE ACCEPT
Explanation: According to the 3GPP specification, certain EMM messages are accepted by the UE without integrity protection in specific situations. These include IDENTITY REQUEST (if requested identification parameter is IMSI), AUTHENTICATION REQUEST, AUTHENTICATION REJECT, ATTACH REJECT (if the EMM cause is not #25 or #78), DETACH ACCEPT (for non switch off), TRACKING AREA UPDATE REJECT (if the EMM cause is not #25 or #78), and SERVICE REJECT (if the EMM cause is not #25 or #78). This allows for secure exchange of NAS messages to be established later.