Question: For untrusted non-3GPP accesses in a 3GPP SAE environment, what is the primary purpose of the additional access authentication (beyond EAP-AKA for IPsec tunnel establishment) between the UE and the untrusted access network?
Option 1: To ensure billing and accounting for data usage on the untrusted non-3GPP access network.
Option 2: For Quality of Service (QoS) differentiation in the Evolved Packet Core (EPC).
Option 3: For the security of the untrusted non-3GPP access network itself, as determined by the access network provider.
Option 4: To facilitate handover between different non-3GPP access technologies.
Explanation: This is correct because the additional access authentication is specified as being for the security of the untrusted non-3GPP access network and is at the discretion of the access network provider, highlighting its importance for securing the access network itself, beyond the EPC's security needs.