Question: In RNAA deployments supported by CAPIF, where is the API Invoker **NOT** permitted to be deployed if it needs to access resources of a Resource Owner connected via a different UE?
Option 1: On the Network as an Authorization Function (AF)
Option 2: On the same UE as the Resource Owner Client
Option 3: On a UE supporting multiple 3rd party applications, including itself as an AF
Option 4: On a UE if the Resource Owner is connected via a different UE
Explanation: According to RNAA deployments in CAPIF, when the API Invoker is deployed on a UE, it is only allowed to access resources of the Resource Owner corresponding to **that specific UE**. Therefore, if the Resource Owner is connected via a **different UE**, deploying the API Invoker on any UE would not grant it access to those resources.