Question: In an NDS/IP case for the Zb-interface, where both Network Entities (NEs) belong to the same administrative domain, how does NE-A verify the certificate of NE-B during IKEv2 connection negotiation?
Option 1: By cross-certification with a trusted external CA
Option 2: Using the Operator's NE CA certificate for verification within the same domain
Option 3: Solely through CRL databases or OCSP server checks without CA verification
Option 4: By skipping certificate verification due to being in the same domain
Explanation: Since both NEs are in the same administrative domain, there's no need for cross-certification. The verification process, as outlined, involves checking the validity of NE-B's certificate using the Operator's NE CA certificate, which is common to both entities within that domain, ensuring trust and authenticity without requiring external CAs for this specific step.