Question: In the context of Network Domain Security (NDS) Authentication Framework, how does an Operator Registration Authority/Certification Authority (RA/CA) verify the identity of a Network Function (NF) instance during certificate enrollment or renewal?
Option 1: By matching the NF instance's IP address with the one stored in the operator's database.
Option 2: By verifying the nfInstanceID included in the Subject Alt Name field of the certificate signing request against known NF identities.
Option 3: Through a separate, out-of-band authentication process using shared secret keys.
Option 4: By relying on the NF instance's self-reported name without further verification.
Explanation: This is correct because the nfInstanceID is included in the Subject Alt Name field of the certificate signing request, allowing the Operator RA/CA to verify the NF instance's identity by matching this ID with established trusted identities, ensuring authenticity and preventing impersonation attacks.