Every question of this course

Q1.1 Which of the three stages does TS 23.501 belong to?

• Stage 2, the architecture
• Stage 3, the protocols
• Stage 1, the requirements

The first sentence of the scope says the document defines the Stage 2 system architecture for the 5G System. §1

Q1.2 In a version number x.y.z, what does a first digit of 2 mean?

• The document is approved and under change control
• The document has been through two releases
• The document has been presented to the plenary for approval but is not yet approved

The Foreword spells the three cases out. A first digit of 1 means presented for information, 2 means presented for approval, and 3 or greater means approved and under change control. §Foreword

Q1.3 Once the document is under change control, what does its first digit track?

• Which release it belongs to
• How mature the editors think it is
• How many times it has been revised

The change history shows 16.0.0 approved at SP#83, 17.0.0 at SP#91E and 20.0.0 at SP#110, each one the opening version of a release. §Annex X

Q1.4 Which two documents does the scope name as companions to this one?

• TS 23.502 and TS 23.503
• TS 24.501 and TS 29.500
• TS 23.401 and TS 23.402

The scope names TS 23.502 for the procedures and flows, and TS 23.503 for policy control and charging. All three are stage 2. §1

Q1.5 Many change-history lines share one TDoc number, such as SP-260441. What does that tell you?

• The change request was revised several times
• The same change was approved several times
• One document carried several change requests to the same meeting

The TDoc is the paper submitted to the plenary. Related changes travel together in one pack, so one TDoc number covers many change requests. §Annex X

Q2.1 A reference is written without a date or version number. Which version applies?

• The latest version of that document in the same release as TS 23.501
• The version current when TS 23.501 was first published
• Any version, at the implementer's choice

Clause 2 calls that a non-specific reference. For a 3GPP document it points at the latest version in the same release as the document you are holding, so the target moves as the release does. §2

Q2.2 A term is defined both in clause 3.1 and in TR 21.905. Which definition applies here?

• The one in TR 21.905, because it is the vocabulary document
• Neither, the conflict has to be reported to 3GPP
• The one in clause 3.1

Clause 3.1 says a term defined in the present document takes precedence over the same term in TR 21.905. The same rule is repeated for abbreviations in clause 3.2. §3.1

Q2.3 What does the letter in a clause number like 4.2.5a tell you?

• The clause is optional
• The clause belongs to a different release
• The clause was inserted after 4.2.5 without renumbering everything below it

A letter suffix is how a new clause is slotted between two existing ones. 4.2.5a sits between 4.2.5 and 4.2.6, and every cross reference to 4.2.6 elsewhere stays valid. §4.2.5a

Q2.4 A NOTE says a feature is not supported in this release. How binding is that?

• Not binding at all, a NOTE is only explanation
• It is the only place the restriction is stated, so you have to obey it
• It is binding only if the clause above it says "shall"

A NOTE carries no "shall", but the restriction it records is often stated nowhere else. Clause 5.2.5 is one of them, and an implementation that ignores it is wrong. §5.2.5

Q2.5 A clause title reads only "Void". What happened?

• The clause was moved into an annex
• The content was deleted and the number was retired so nothing below it shifts
• The clause is still being drafted

Deleting a clause outright would renumber everything after it and break every cross reference in every other specification. The number stays and the body becomes the single word "Void". §5.8.2.15

Q2.6 You need the exact message sequence for a device registering with the network. Where does clause 1 send you?

• To TS 23.502
• Deeper into TS 23.501, in clause 5.3
• To TS 24.501

The scope names TS 23.502 as the companion holding the stage 2 procedures and flows. TS 23.501 describes what registration is for and which function owns it, never the sequence. §1

Q3.1 How may two control plane functions in the 5G core talk to each other?

• Either, depending on the vendor
• Only over a point-to-point reference point
• Only over a service-based interface

The specification says control plane network functions shall only use service-based interfaces for their interactions. The reference points between them are names for those same conversations, not a second way of having them. §4.2.1

Q3.2 What is "Nsmf"?

• The protocol the SMF speaks to the radio network
• The link between the SMF and the UPF
• The service-based interface the SMF offers to others

A name of the form N + lower-case function name is the interface a function exhibits, meaning the set of services it offers. It belongs to one function, not to a pair of them. §4.2.6

Q3.3 Which of these is a real point-to-point reference point, not one realized by service-based interfaces?

• N11, between the AMF and the SMF
• N4, between the SMF and the UPF
• N7, between the SMF and the PCF

N1, N2, N3, N4, N6 and N9 are listed before the sentence that says the rest are realized by service-based interfaces. They are the six that genuinely are their own link. §4.2.7

Q3.4 Where does a network function put unstructured data such as a UE context?

• In the UDSF
• In the NRF
• In the UDR

The UDSF holds data whose structure 3GPP does not define. The UDR holds the standardized sets — subscription data, policy data, data for exposure, application data and Ambient IoT data. §4.2.5

Q3.5 What does the specification call the SCP and the SEPP?

• Access network nodes
• Network functions, like the AMF and the SMF
• Network entities, listed separately from the network functions

The list of network functions is followed by a second list, opened with "also comprises the following network entities", and the SCP and the SEPP are on it. The SCP does not offer services of its own. §4.2.2

Q3.6 Is there a roaming architecture for Energy Efficiency and Energy Saving?

• Yes, it mirrors the non-roaming one
• No, this Release does not support it
• Yes, but only for home-routed traffic

The clause defines a non-roaming architecture only and then says in plain words that the roaming architecture is not supported in this Release. §4.2.18.1

Q4.1 The AMF carries session management messages between the phone and the SMF. What does it do with them?

• It passes them on without acting on them
• It rewrites them into a service-based API call
• It reads them and decides which UPF to use

The clause calls the AMF a transparent proxy for routing session management messages. Deciding on a UPF is the SMF's job. §6.2.1

Q4.2 Which function turns a hidden subscription identifier (SUCI) back into the real one (SUPI)?

• The UDR
• The AUSF
• The UDM

De-concealment of the privacy-protected identifier is in the UDM's list, together with generating the authentication credentials. §6.2.7

Q4.3 Why can two different UDM instances serve the same subscriber in two different transactions?

• Because the NRF replicates UDM state between instances
• Because the UDM keeps a copy of every subscriber locally
• Because the subscription data can sit in the UDR instead of inside the UDM

The UDM may hold only the application logic and read its data from the UDR, so no instance owns the subscriber. §6.2.7

Q4.4 Which function counts how many devices are registered to a network slice?

• The NSACF
• The NWDAF
• The NSSF

The NSSF picks the slice; the NSACF monitors and controls the number of registered devices and of established sessions per slice. §6.2.28

Q4.5 What does the SEPP do to control-plane messages travelling between two operators?

• Encrypts the user's traffic on the N3 tunnel
• Filters and polices them, and hides the internal topology
• Repeats the sending function's authorization check

Filtering, policing and topology hiding are its two jobs, and a note says it deliberately does not repeat the producer's authorization. §6.2.17

Q4.6 A function knows only a device's IP address and needs the PCF that handles it. Where does it start?

• It asks the BSF, which maps the address back to the subscriber
• It asks the UPF that owns the address
• It queries the NRF with the IP address

The BSF holds the registration a PCF made for itself, and a consumer with only an IP address, DNN and slice uses it to get the SUPI. §6.3.3.1

Q5.1 Why does the same piece of behaviour need two different reference point names when it sits between two different pairs of functions?

• Because 3GPP ran out of short names
• Because the protocol differs on each
• Because a reference point is named after the pair it joins, not after what it does

A reference point is the conceptual point where two functional groups meet, so its name belongs to that pair. A service-based interface belongs to the producer alone, so one name covers every consumer that calls it. §Annex A

Q5.2 What must a consumer put in a subscribe request?

• A polling interval
• The producer's NF instance ID
• A notification endpoint - a target address and a correlation ID

The producer has to be told where to send the notification and how the consumer will recognise which subscription it belongs to. §7.1.2

Q5.3 In communication model D, who finds the producer?

• The consumer, by asking the NRF
• The consumer, from local configuration
• The SCP, from parameters the consumer put in the request

Model D is indirect communication with delegated discovery. The consumer does no discovery and no selection at all; it adds the parameters and the SCP does the rest. §E.1

Q5.4 A network function is told to serve traffic through an SCP. Does that settle how all its messages travel?

• Yes, every message then goes through the SCP
• No, it is per consumer or producer local configuration, and an NF may not use the SCP for all of it
• No, the NRF decides message by message

Direct and indirect are chosen from the local configuration of the consumer or producer, and the clause says plainly that an NF may not use an SCP for all its communication. §7.1.1

Q5.5 What does the NRF check during service discovery, as opposed to what the producer checks later?

• Both check exactly the same thing, twice
• The NRF checks per UE; the producer checks per NF type
• The NRF checks per NF whether the consumer may discover the producer; the producer checks per request, per UE or subscription

Authorization has two steps at two different granularities. The per-request, per-UE check is embedded in the service logic of the producer, not in the NRF. §7.1.4

Q5.6 How many services does the SCP itself produce?

• One per network function it proxies
• None - it only forwards
• One, Nscp_EventExposure

The SCP has a single service that exposes SCP related information to consumer NFs. Everything else it does is forwarding on behalf of real producers. §7.2.30

Q6.1 What has to happen before a function can be found through the NRF?

• It has to be listed in the DNS
• It has to register its NF profile with the NRF
• It has to be named in the subscription data

Discovery only works for instances that registered, and registration is one message carrying the NF profile. §6.3.1

Q6.2 You get a discovery answer back from the NRF. What may you do with it?

• Use it once, for this subscriber only
• Cache it for a validity period and reuse it for any subscriber that matches the same discovery criteria
• Cache it forever

The result belongs to the criteria, not to the person, and the answer carries a validity period saying how long it may be cached. §6.3.1

Q6.3 A producer gives you a binding indication at NF Set level and then stops answering. Where may you go?

• Anywhere, the binding is only a hint
• Any equivalent service instance inside that NF Set
• Only the exact service instance named

The level of the binding is the width of the allowed reselection, and NF Set is the widest of the four. §6.3.1.0

Q6.4 A phone already has a session to one data network and asks for a second one to the same DNN and slice. When is the AMF forced to reuse the same SMF?

• When the subscription says EPS interworking is supported for that pair, or that the same SMF is required
• Always
• Never, a new session always gets a new SMF

Without one of those two subscription flags a different SMF may be picked, which is how load balancing and graceful shutdown work. §6.3.2

Q6.5 Where can the SMF learn what a UPF is capable of?

• Only from local configuration
• From the N4 association procedure, or from the NRF
• Only from the NRF

The N4 node-level exchange is a first-class source of capability information, and asking the NRF is optional on top of it. §6.3.3.1

Q6.6 Must the PCF chosen by the AMF for the device be the same PCF the SMF chooses for a session?

• They must always be different
• Yes, always the same instance
• They may be the same or different

The specification says plainly that the two selections may land on the same instance or on different ones. §6.3.7.1

Q7.1 Why does a phone almost never send its SUPI to the network?

• Because the SUPI is only created after registration
• Because the SUPI is too long for a radio message
• Because the UE provides the SUPI in concealed form instead

When the UE has to indicate its SUPI, it provides it concealed — that concealed form is the SUCI. The SUPI itself is used only inside the 3GPP system. §5.9.2

Q7.2 What are the two parts of a 5G-GUTI?

• An MCC and an MNC
• A SUPI and an AMF Name
• A GUAMI and a 5G-TMSI

The structure is a GUAMI followed by a 5G-TMSI. The GUAMI identifies one or more AMFs; the 5G-TMSI identifies the UE within them. §5.9.4

Q7.3 Is there one GPSI for every SUPI?

• Yes, exactly one each
• No — the specification states there is no implied 1-to-1 relationship
• Only for subscriptions with an MSISDN

A GPSI is either an MSISDN or an External Identifier, and the note in the clause says plainly that no 1-to-1 relationship is implied. §5.9.8

Q7.4 A device supports no 3GPP access technology at all. What form does its PEI take?

• An IMEI, always
• It gets no PEI
• The IEEE Extended Unique Identifier EUI-64 of the access technology it uses

The IMEI or IMEISV format is required only for UEs that support at least one 3GPP access technology. §5.9.3

Q7.5 Moving from 5G to 4G with N26 in use, what does the 5G-TMSI become?

• The EPS M-TMSI
• The EPS MMEGI
• The EPS MMEC

In the mapping, MCC and MNC carry over, AMF Region ID and AMF Set ID become MMEGI and part of MMEC, the AMF Pointer becomes the rest of MMEC, and the 5G-TMSI becomes the M-TMSI. §Annex B

Q7.6 On 3GPP access, what does a UE do with NSSAI in the access stratum by default?

• Includes it only during Service Request
• Does not provide NSSAI in the access stratum at all
• Always includes the Allowed NSSAI

Mode d) is the default for 3GPP access, and the serving AMF may not instruct any other mode unless the home network has said it is allowed. §5.15.9

Q8.1 What sits directly under NGAP on N2, between the access network and the AMF?

• GTP-U
• TCP
• SCTP

The legend of the N2 stack names SCTP, which guarantees delivery of signalling messages between the AMF and the access node. §8.2.1.2

Q8.2 A phone is served by one AMF over 3GPP access and non-3GPP access at the same time. How many N1 NAS signalling connections does it have?

• One, shared by both accesses
• One per access, so two
• One per PDU session

A single N1 connection is used for each access the UE is connected to, even when a single AMF serves both. §8.2.2.1

Q8.3 What does the AMF do with the session-management part of a NAS message?

• Passes it on without interpreting the content
• Reads it and acts on it
• Rewrites it into a request of its own

The SM message is created and processed in the NAS-SM layers of the UE and the SMF. The AMF handles only the NAS-MM part around it. §8.2.2.3

Q8.4 At what granularity does GTP-U encapsulate user traffic on N3 and N9?

• Per device
• Per QoS Flow
• Per PDU session

The legend says GTP encapsulates all end user PDUs and provides encapsulation on a per PDU Session level. The QoS Flow marking rides inside that same layer. §8.3.1

Q8.5 Which protocol does TS 23.501 name for the service-based interfaces?

• HTTP/3 over QUIC
• None — it points at another specification instead
• HTTP/2 over TCP

Clause 8 gives the service-based interfaces one sentence, and that sentence hands the whole stack to TS 29.500. §8.2.3.1

Q8.6 On untrusted non-3GPP access, what may fragment a large NAS message?

• The inner IP layer or TCP
• GTP-U
• SCTP

Once the signalling IPsec security association is up, NAS rides on TCP over an inner IP layer, and either of those two may fragment. §8.2.4

Q9.1 A registered phone is in your pocket overnight, sending nothing. Which pair of states is it in?

• RM-DEREGISTERED and CM-IDLE
• RM-REGISTERED and CM-IDLE
• RM-REGISTERED and CM-CONNECTED

The network holds its context and can page it, but there is no AN signalling connection, no N2 connection and no N3 connection. §5.3.3.2.2

Q9.2 What makes a registered device start a Mobility Registration Update?

• When the tracking area of its serving cell is not in the TAI list it was given
• When its radio signal drops below a threshold
• Every time it changes cell

The TAI list is exactly the area inside which the device may move silently. Leaving it is what breaks the AMF's ability to page. §5.3.2.2.3

Q9.3 A device is CM-CONNECTED with RRC_INACTIVE. Who pages it?

• The radio network
• The SMF that owns its PDU session
• The AMF, as usual

In RRC_INACTIVE the RAN manages reachability and paging, with assistance information from the core. §5.3.3.2.3

Q9.4 A Forbidden Area and a Service Area Restriction both cover where the device is standing. Which one applies?

• The Forbidden Area
• Whichever the network sent most recently
• The Service Area Restriction, because it is more specific

The specification gives one explicit precedence rule — evaluation of Forbidden Areas takes precedence over Service Area Restrictions. §5.3.4.1.1

Q9.5 What does the network send a device whose service area is limited?

• An Allowed Area and a Non-Allowed Area together
• Only one of the two, never both at once
• A list of individual cells

If an Allowed Area is sent, everything outside it is non-allowed; if a Non-Allowed Area is sent, everything outside it is allowed. §5.3.4.1.1

Q9.6 With dual connectivity, how many N2 termination points does one device have?

• One per PDU session
• One, at the Master RAN node
• Two, one per radio node

Two radio nodes provide radio resources, but a single N2 termination point exists between the AMF and the RAN. §5.11.1

Q10.1 A device is in CM-CONNECTED with RRC_INACTIVE and a packet arrives for it. Who pages it?

• The AMF, over N2
• The NG-RAN, inside the RAN Notification Area
• Nobody — the device is unreachable until it speaks first

In CM-IDLE the AMF pages. In RRC_INACTIVE the N2 connection is still up, so the radio network keeps the device and pages it itself. §5.4.3.1

Q10.2 Why does the AMF hold on to the UE Radio Capability information?

• Because it is large, and resending it over the air at every idle-to-connected transition would be wasteful
• Because the device cannot store it itself
• Because the core needs to read it to pick a frequency band

The core stores the blob and hands it to the radio network, without understanding its contents, purely to keep it off the air interface. §5.4.4.1

Q10.3 What makes a non-3GPP access network "trusted"?

• It uses stronger encryption than an untrusted one
• The device reaches it without an IPsec tunnel
• It advertises trusted connectivity for a PLMN, so the device picks the PLMN first and the access second

Both kinds use IPsec to the gateway. What differs is the advertisement and the order of selection. §4.2.8.1

Q10.4 A device is CM-IDLE over Wi-Fi and a downlink packet arrives for a session last routed there. What can the network do?

• Nothing; the PDU session is released
• Page it over the Wi-Fi access
• Run a network triggered Service Request over the 3GPP access, if the device is registered there in the same PLMN

A device cannot be paged over non-3GPP access at all, so the core uses the other access and marks the request as being about the non-3GPP side. §5.5.3.1

Q10.5 With non-seamless WLAN offload, which IP address does the offloaded traffic use?

• The one from the WLAN access network, with no address preservation towards NG-RAN
• The one from the PDU session, preserved across both accesses
• A second address handed out by the UPF

The traffic never goes through the 5G core, so the core has no address to preserve and no control over the flow. §5.42

Q10.6 Which value travels in the core-network tunnel header so a gNB can pick a paging policy for a device in RRC_INACTIVE?

• The Mobile Reachable timer
• The Paging Policy Indicator
• The 5QI

The SMF tells the UPF to detect the DSCP and put the matching PPI in the tunnel header, because the gNB pages on its own and never sees the SMF. §5.4.3.2

Q11.1 A phone registered on the same network over both radio and Wi-Fi wants a multi-access session. How many establishment requests does it send?

• Two, one over each access
• Three — one per access and one to bind them
• One, over either access

When both registrations are with the same PLMN one request is enough, with Request Type "MA PDU Request" carried in the UL NAS Transport message that conveys it; the AMF tells the SMF the device is on both accesses and both tunnels are set up. Two requests are only needed when the two registrations are with different PLMNs. §5.32.2

Q11.2 Which steering mode sends the same packets over both accesses at once?

• Redundant
• Load-Balancing
• Priority-based

Load-Balancing splits traffic by percentage and Priority-based spills onto the second access only when the first is congested. Only Redundant duplicates. §5.32.8

Q11.3 Which steering functionality can carry every kind of traffic but cannot do the Redundant steering mode?

• ATSSS-LL
• MPQUIC-UDP
• MPTCP

ATSSS-LL applies no protocol of its own and handles TCP, UDP and Ethernet alike, but the specification states it does not support the Redundant Steering Mode. §5.32.6.3.1

Q11.4 How does a round-trip-time measurement get from the phone to the UPF?

• The SMF collects both and sends them on
• The phone reports its result to the UPF over the user plane
• It does not — each side measures for itself

Both ends send PMF-Echo Requests and answer each other's, and each derives its own average. There is no reporting of the result from one side to the other. §5.32.5.2

Q11.5 Can a guaranteed-bit-rate flow of a multi-access session be split across the two accesses?

• No — splitting is not supported for a GBR flow
• Only when both access networks accept the QoS profile
• Yes, with Load-Balancing percentages

The specification says plainly that traffic splitting is not supported for a GBR QoS Flow; the SMF picks one access, except under the Redundant steering mode where both get the profile. §5.32.4

Q11.6 What does the MPTCP proxy in the UPF use as the source address when it talks to the far-end server?

• The link-specific multipath address of whichever access the packet arrived on
• The IP address of the multi-access session itself
• Its own N6 address

The two link-specific multipath addresses are used only between phone and proxy and may not be routable on N6. The proxy uses the session's own address towards the final destination. §5.32.6.2.1

Q12.1 Which attribute of a PDU session may change while the session is alive?

• The SSC mode
• The S-NSSAI of the serving PLMN
• The DNN

The serving network's slice identifier can change when the UE moves to a different PLMN while keeping the session. DNN, session type, SSC mode and session ID are all fixed for the lifetime of the session. §5.6.1

Q12.2 What happens to the IP address under SSC mode 3?

• A new anchor is set up before the old one goes away, and the address is not preserved
• The session is released and the device must build a new one
• It is preserved, whatever the device does

SSC mode 3 is make-before-break. The new anchor brings a new address or prefix, the old one is kept for a stated time, then released. §5.6.9.2.3

Q12.3 Which session types may be given SSC mode 3?

• IP types only
• Ethernet and IP
• Any of the five

The specification says the UE shall not request and the network shall not assign SSC mode 3 for an Unstructured or an Ethernet session. §5.6.9.3

Q12.4 An uplink classifier has been inserted into an IPv4 session, so there are now two anchors. How many IPv4 addresses does the device hold?

• One, and the device is not told the second anchor exists
• None — the classifier does the addressing
• One per anchor

The device is unaware of the traffic diversion and is not involved in inserting or removing the classifier. Only one address or prefix is given out. §5.6.4.2

Q12.5 A device carrying a local-area data network session walks out of the service area. What does the specification require of the device?

• Nothing changes until the network says so
• Release the session at once
• Stop asking for the user plane and stop establishing or modifying the session, but it need not release it

Out of area the device must not activate the user plane, send data or establish and modify the session — but it need not release an existing one unless the network asks. §5.6.5

Q12.6 What does marking a session always-on actually change?

• User plane resources are activated on every move from idle to connected, even with nothing to send
• The session gets a guaranteed bit rate
• The radio link is never released

An always-on session is one whose user plane has to come up on every idle-to-connected transition, and the device asks for it even with no pending uplink data. §5.6.13

Q13.1 Which N4 rule decides whether a packet is forwarded, dropped or buffered?

• The Packet Detection Rule
• The Forwarding Action Rule
• The QoS Enforcement Rule

The PDR only classifies; the Action attribute is the FAR's, and it is what says forward, duplicate, drop or buffer. §5.8.5.6

Q13.2 Does the SMF send the ARP (Allocation and Retention Priority) to the UPF?

• No — ARP is for admission control and is not required at the UPF
• Only for GBR flows
• Yes, the UPF uses it to drop flows under load

ARP decides which flows are admitted and pre-empted. The clause says plainly that its value is not required to be provided to the UPF. §5.8.2.7

Q13.3 Who allocates the CN Tunnel Info (the TEID and IP address) for an N3 or N9 tunnel?

• The SMF, which then tells the UPF
• The UPF, when the SMF asks it to
• The radio network

Allocation and release are performed by the UPF; the SMF only indicates when a new one is needed and when to release it. §5.8.2.3.3

Q13.4 When DHCP is used towards the UE, which function acts as the DHCP server?

• The external data network, always
• The PDU Session Anchor UPF
• The SMF

The SMF is the DHCP server towards the UE. The anchor UPF has no DHCP function at all; it is only told to forward the packets. §5.8.2.2.1

Q13.5 Buffering of downlink packets for a deactivated session is mandatory where?

• In the UPF, and optional in the SMF
• In the SMF, and optional in the UPF
• In both

Support in the UPF is mandatory and in the SMF optional, and the SMF chooses which of the two does the buffering. §5.8.2.19.1

Q13.6 Annex J works out a worst-case overhead of 142 octets. What link MTU does that leave on a 1500-octet transport?

• 1280
• 1500
• 1358

1500 minus 142 is 1358, and the annex says that value is small enough for most deployments. 1280 is the separate figure that leaves room for a tunnel the UE itself runs. §Annex J

Q14.1 What is the finest thing 5G can give a separate quality treatment to?

• A PDU session
• A QoS Flow
• A single IP packet

All traffic marked with the same QFI inside one PDU session gets the same forwarding treatment, so the flow is the unit — not the session and not the packet. §5.7.1.1

Q14.2 What does a 5QI value actually carry?

• A bit rate in kilobits per second
• The radio channel the flow will use
• A reference to a set of QoS characteristics such as priority, delay and error rate

A 5QI is a scalar used as a reference to the characteristics in the standardised table. Bit rates are separate parameters. §5.7.2.1

Q14.3 In the ARP priority level, which end of the range 1 to 15 is the important one?

• Neither — ARP has no priority level
• 15, because higher is better
• 1, because 1 is the highest priority

The range is 1 to 15 with 1 as the highest priority, and levels 1 to 8 are meant for services the serving network has authorised. §5.7.2.2

Q14.4 Session-AMBR limits the total bit rate across which flows of a PDU session?

• Only the flow carrying the default QoS rule
• Only the non-GBR flows
• All flows, GBR and non-GBR alike

Session-AMBR caps the aggregate across all non-GBR QoS Flows of the session and is explicitly not applicable to GBR QoS Flows. §5.7.2.6

Q14.5 A phone has an uplink packet that matches none of its QoS rules. What happens?

• The phone asks the network for a new rule
• It goes out on the flow of the default QoS rule
• The phone discards it

For IP and Ethernet sessions the rules are evaluated in precedence order, and if no rule matches, the UE discards the uplink packet. §5.7.1.5

Q14.6 With notification control on, what does the radio network do when it can no longer meet the guaranteed bit rate?

• Release the flow immediately
• Silently lower the rate and say nothing
• Keep the flow and tell the SMF that the GFBR can no longer be guaranteed

The point of notification control is that the flow survives the bad patch while the application is told to adapt. §5.7.2.4.1a

Q15.1 Clause 5.14 of TS 23.501 is one sentence. What does it say?

• That the AMF decides all policy
• That policy control is out of scope for the 5G System
• That the policy and charging control framework is defined in TS 23.503

The whole clause is a hand-over to TS 23.503. Everything 23.501 keeps about policy lives in other clauses — the PCF description, PCF selection, the services table, and the enforcement clauses under 5.7 and 5.8. §5.14

Q15.2 Session binding is the problem of connecting what to what?

• An application function's service session to the PDU session it belongs to
• A subscriber to a slice
• A QoS Flow to a data radio bearer

The PCF has to correlate the AF service session over N5 or Rx with the PDU session it handles over N7, which is why a session must be uniquely identifiable from the UE address and DNN as well as from the UE ID. §6.3.7.0

Q15.3 What does the BSF do?

• It enforces bandwidth limits in the user plane
• It stores charging records until the billing system collects them
• It lets a PCF register itself so other functions can discover which PCF serves a session

Nbsf_Management allows a PCF to register and deregister itself and to be discoverable. The PCF for the UE and the PCF for the PDU session register separately. §7.2.15

Q15.4 Which function actually counts the bytes for charging a PDU session?

• The base station, for all traffic
• The UPF, which reports usage data to the SMF
• The CHF, which taps the N6 interface

The UPF collects and reports usage data to the SMF over N4; the SMF adds session and subscriber meaning and talks to the CHF. §5.12.1

Q15.5 A PCC rule says "non-blocking" for service data flow handling while credit is requested. What happens to the traffic?

• It flows against a default threshold while the SMF waits for quota
• It is dropped until the CHF grants quota
• It is redirected to a top-up page

The SMF asks the UPF to report usage for that charging key and gives it a default threshold, so the traffic is not held up while the quota request is outstanding. §5.8.2.6.2

Q15.6 A phone has URSP rules. What does the Network Slice Selection Policy part of them decide?

• Which slice the radio network puts the phone in
• Which S-NSSAI the phone asks for when an application needs a session
• How much of the slice's capacity the phone may use

NSSP rules associate an application with one or more HPLMN S-NSSAIs; the phone uses that to pick the S-NSSAI it indicates at PDU session establishment, or indicates none if it cannot determine one. §5.15.5.3

Q16.1 Where are the authentication methods and key derivations of 5G defined?

• In TS 23.502, with the procedures
• In clause 5.10 of this document
• In TS 33.501

Clause 5.10 lists the security features and then says that the detailed security related network functions for 5G are described in TS 33.501. §5.10.1

Q16.2 Which function decides the User Plane Security Enforcement information for a PDU session?

• The NG-RAN, because it does the ciphering
• The UE, from its own settings
• The SMF, at PDU session establishment

The SMF determines it from the subscribed policy in the UDM, its own local policy per DNN and S-NSSAI, and the maximum integrity rate the UE reported. The NG-RAN only enforces it. §5.10.3

Q16.3 The radio network cannot meet a User Plane Security Enforcement value of "Required". What happens?

• It downgrades the value to "Preferred"
• It carries the traffic unprotected and notifies the SMF
• It rejects the establishment of user-plane resources for that session

Rejecting is the defined behaviour for Required, and the SMF then releases the PDU session. Carrying on and notifying is what happens for Preferred. §5.10.3

Q16.4 Which function de-conceals the SUCI back into a SUPI?

• The AUSF, before it starts authentication
• The UDM
• The AMF, as soon as the registration arrives

Support of de-concealment of the privacy-protected subscription identifier is listed as a UDM function; the serving network only reads the routing fields that were never concealed. §6.2.7

Q16.5 What has to have happened before slice-specific authentication can run for a device?

• The device must already have a PDU session on that slice
• The slice must already be in the Allowed NSSAI
• Primary authentication of the SUPI must have succeeded

NSSAA requires successful primary authentication of the SUPI, and if the SUPI authorization is revoked the slice authorization goes with it. §5.15.10

Q16.6 Which credentials does the remote provisioning of clause 5.39 deliver?

• The home network public key used to conceal the SUPI
• Credentials for primary authentication, for a device with no subscription
• Credentials for slice-specific authentication or for secondary authentication

Clause 5.39 covers exactly those two. Provisioning credentials for primary authentication is onboarding, and lives in clause 5.30. §5.39.1

Q17.1 How many S-NSSAIs may the Allowed NSSAI carry in signalling between the device and the network?

• As many as the subscription holds
• Sixteen
• Eight

At most eight in the Allowed NSSAI and in the Requested NSSAI. The UDM sends the AMF up to sixteen, but only eight fit in the messages. §5.15.2.1

Q17.2 What is the Slice Differentiator, the SD part of an S-NSSAI, for?

• To say how much bandwidth the slice guarantees
• To name the data network the slice reaches
• To tell apart several slices that have the same Slice/Service type

The SD is optional extra information that separates several slices of the same SST — for example one per business customer. §5.15.2.1

Q17.3 A device asks for slices, none of them are in its subscription, and it has default subscribed slices. What does the network do?

• It rejects the registration outright
• It serves the device with the slices marked as default in the subscription
• It picks the closest matching slice by SST value

When no requested S-NSSAI is permitted, the AMF or NSSF builds the Allowed NSSAI from the S-NSSAIs marked as default in the subscription. §5.15.5.2.1

Q17.4 A slice needs its own authentication and it has not finished yet. Where does that S-NSSAI sit meanwhile?

• In the rejected list, until the device asks again
• In the Allowed NSSAI, marked provisional
• In the Pending NSSAI, and out of the Allowed NSSAI

S-NSSAIs under an ongoing slice-specific authentication go in the Pending NSSAI and are removed from the Allowed NSSAI; the device must not ask for them again while they are pending. §5.15.5.2.1

Q17.5 Who keeps the count of PDU sessions in a slice, and who asks it?

• The NSACF keeps the count and the anchor SMF asks it
• The NRF keeps the count and the RAN asks it
• The AMF keeps the count and the NSSF asks it

The NSACF holds the maximum per S-NSSAI and tracks the current number; the anchor SMF triggers the check at session establishment and release. §5.15.11.2.1

Q17.6 While a slice is replaced by an Alternative S-NSSAI, which value does the device use to match an application to a session?

• The Alternative S-NSSAI, since that is where the traffic goes
• The replaced, original S-NSSAI
• Either, whichever the application named

Application-to-session matching by URSP and session establishment stay on the replaced S-NSSAI; the Alternative one is carried alongside it. §5.15.19

Q18.1 In Local Break Out, where does the packet leave the mobile network for the internet?

• In the home network, always
• In the visited network — the anchor and its SMF are both there
• Wherever the phone asks for

Local Break Out is defined as the case where the PDU Session Anchor and the SMF controlling it are in the serving network. §3.1

Q18.2 In a home-routed session, where does the phone's session-management signalling terminate?

• In the V-SMF, in the visited network
• In the AMF
• In the H-SMF, in the home network

NAS SM terminates in the SMF in the VPLMN, which then forwards session management information to the SMF in the HPLMN. §5.6.3

Q18.3 Who decides whether a given session is home routed or broken out locally?

• The visited operator alone
• The home network, through subscription data per DNN and per S-NSSAI
• The phone, in its connection request

The HPLMN controls the mode via subscription data, and different simultaneous sessions of one device may use different modes. §5.6.3

Q18.4 What are the two jobs the specification gives the SEPP?

• Encrypting the user plane and counting bytes
• Selecting the visited SMF and the visited PCF
• Message filtering and policing on inter-PLMN control plane interfaces, and topology hiding

Those are exactly the two bullets in the SEPP clause; everything else about it lives in TS 33.501. §6.2.17

Q18.5 When a visitor uses a non-standard slice value, who maps it?

• Nobody — non-standard values cannot be used abroad
• The home NSSF, which then tells the visited network
• The visited NSSF, based on the agreement, and it need not tell the home network

The NSSF of the VPLMN maps subscribed values to values used in the VPLMN, and need not inform the HPLMN which values it picked. §5.15.6

Q18.6 A visited network cannot meet the QoS the home network asked for. What may the V-SMF do?

• Ask the phone to choose
• Nothing — the home network's QoS is binding
• Refuse the session, refuse some flows, or downgrade values locally

Visited-network policies from the agreement may lead the V-SMF to reject the session or some flows, and it may locally downgrade values. §5.7.1.11

Q19.1 What does the N26 interface join together?

• The MME in the 4G core and the AMF in the 5G core
• The 4G Serving Gateway and the 5G User Plane Function
• The 4G radio network and the 5G radio network

N26 is an interface between two core networks. It carries a subset of what S10 carries between two MMEs, and deploying it is optional. §4.3.1

Q19.2 A device supports both 5G NAS and 4G NAS. Which registration mode must it support?

• Dual-registration mode
• Single-registration mode
• Whichever the network switches on

Single-registration mode is mandatory for any device that supports both 5GC and EPC NAS. Dual-registration mode is the optional extra. §5.17.2.1

Q19.3 The operator does not deploy N26. What keeps a device's IP address across the move?

• The device re-requests the same address from the target core
• The MME and the AMF exchange the session state directly
• The SMF+PGW-C name and its APN/DNN are stored in and fetched from the HSS+UDM

Without N26 there is no direct core-to-core exchange, so the shared subscriber database holds the anchor's name and hands it to the target core. §5.17.2.3.1

Q19.4 An Ethernet PDU session moves to a 4G core that does not support the Ethernet PDN type. What happens to it?

• It is refused and the device must build an IP session instead
• It is carried as an IP session with the frames tunnelled inside
• It is carried as PDN type "non-IP", and both sides remember it was Ethernet

Ethernet and Unstructured both become "non-IP" in that case, and the device and the SMF keep the real type so it is restored on the way back. §5.17.2.1

Q19.5 In one E-UTRA cell wired to both cores, what tells the base station to route the signalling to an AMF rather than an MME?

• The tracking area code broadcast in that cell
• A "5GC requested" indication the device's radio layer sends
• The device's subscription, read from the HSS+UDM

The device's NAS layer tells its radio layer that it wants the 5G core, and the radio layer passes that on as an explicit indication. §5.17.1.1

Q19.6 A dual-registration device wants to register in 4G before it moves anything. What must the 4G side support?

• Attach without a PDN connection
• Attach with the Request Type flag set to "handover"
• Two S1 connections from one base station

Early registration means registering with nothing to carry yet, so the EPC has to allow an attach that establishes no PDN connection at all. §5.17.2.3.3

Q20.1 Why does the core pick a user plane function close to the device for edge computing?

• To shorten the end-to-end delay and take load off the transport network
• To save IP addresses
• Because the radio cannot reach a distant server

The clause names exactly those two gains — reduced end-to-end latency and reduced load on the transport network. §5.13

Q20.2 An application the operator does not trust to talk to core functions directly must reach them how?

• Over the N6 interface
• Through the NEF, using the external exposure framework
• It cannot reach them at all

Trusted application functions may be allowed to interact directly. Everything else shall use the external exposure framework via the NEF. §6.2.10

Q20.3 Which of these is NOT one of the five categories of external exposure?

• Provisioning
• Radio scheduling
• Monitoring

The five are monitoring, provisioning, policy/charging, analytics reporting and member UE selection. Nothing in the list touches the radio scheduler. §5.20

Q20.4 What is an AF specific UE Identifier?

• The subscriber's phone number
• A GPSI in External Identifier form, and a different one for each application
• The device's current IP address

It shall not correspond to an MSISDN, it is a GPSI in the form of an External Identifier, and the value handed out is different for different application functions, to protect privacy. §5.20

Q20.5 In user plane direct exposure, who sends the report to the consumer?

• The device itself
• The UPF, following instructions the SMF gave it
• The AMF, after paging the device

The function lets the UPF report network information directly to the consumer based on instructions provided by the SMF, bypassing SMF, PCF and NEF on the reporting path. §5.20d.1

Q20.6 Must an application use the NEF's member UE selection to pick devices for a training round?

• No — it may select the devices itself from exposure data and analytics
• Only when the devices are roaming
• Yes, there is no other way

The clause says the AF decides whether to use the function, and that without it an AF in either domain can select the members itself using location reporting, user plane information and analytics. §5.46.2

Q21.1 A phone with no valid subscription dials the emergency number. What does the specification say the network may do?

• Provide it only if the phone has previously registered in that country
• Reject it — every session needs an authenticated subscriber
• Provide the service anyway, if local regulation says so

A network supporting Emergency Services for phones in limited service state provides them regardless of whether the phone can be authenticated, has roaming or mobility restrictions, or a valid subscription. §5.16.4.1

Q21.2 The network tells a phone "IMS voice over PS session supported". What does that promise?

• The call will be carried over the 5G radio the phone is using now
• That voice will work, possibly by moving the phone to 4G first
• That the phone is already registered with the IMS

The indication may also be set when neither NR nor E-UTRA connected to 5GC can carry the call, as long as the radio network can hand over or redirect the phone to EPS when the voice flow is asked for. §5.16.3.2

Q21.3 What does the UPF do with traffic on an emergency PDU session that is not addressed to an emergency function?

• Blocks it
• Charges it at the normal rate
• Moves it to the phone's other PDU session

The flows of the emergency DNN are dedicated to IMS emergency sessions, and the UPF blocks anything that is not from or to the addresses of functions providing Emergency Services, such as the P-CSCF. §5.16.4.9

Q21.4 A visiting phone makes an emergency call. Which network's SMF serves it?

• Whichever the roaming agreement names
• The home network's, so the subscription applies
• The serving network's, always

Emergency SMF selection always derives an SMF in the serving PLMN or SNPN, which is what guarantees the IP address is allocated there too. §5.16.4.5

Q21.5 Can a phone's SMSF be changed while it stays registered in the same network?

• No — SMSF reallocation while registered is not supported in this release
• Only for roaming phones
• Yes, at every AMF change

Each phone has one SMS Function in the registered PLMN, and reallocation while it is in RM-REGISTERED state in that network is not supported. §4.4.2.1

Q21.6 What does an MPS subscription entitle in the USIM?

• A second IMSI
• A reserved 5QI value
• A special Access Identity

The subscription entitles a USIM with a special Access Identity, which is what Unified Access Control uses to let the phone in ahead of ordinary ones when the radio is congested. §5.16.5

Q22.1 What kind of PDU session must a device have before any of these features work?

• An always-on PDU session
• A home-routed PDU session
• An SSC mode 3 PDU session

The UE has to ask for an always-on session. Home routing is not supported, only SSC mode 1 is, and the session does not survive a move to 4G. §5.27.0

Q22.2 The NW-TT stamped a Sync message on the way in, the DS-TT stamps it on the way out. What does the difference become?

• The residence time, written into the message's correction field
• The offset between 5G time and grandmaster time
• The link delay to the next node outside 5G

With the grandmaster outside the 5G system, the time carried in the message is never rewritten. The system measures how long it held the message and adds that to the correction field. §5.27.1.2.2

Q22.3 What is one 5GS TSN bridge made of?

• The ports on one UPF, the tunnels to the UEs, and the DS-TT ports
• Every UPF that serves the same factory
• One base station and the cells it serves

The bridge is per UPF, per network instance or DNN and slice, and its bridge ID is bound to the UPF ID. §5.28.1

Q22.4 TSCAI gives the radio a Burst Arrival Time. Expressed against which clock?

• The 5G clock
• UTC, always
• The external TSN grandmaster clock

The SMF maps the value from the external clock to the 5G clock using the offset and rate ratio the UPF measures and reports. §5.27.2.1

Q22.5 The radio cannot line the requested burst arrival up with a transmission opportunity. What may it send back?

• A refusal of the QoS Flow
• Nothing — the schedule is fixed once set
• A Burst Arrival Time offset, which the application then applies

If the application said it can adapt, the radio returns an offset inside the burst arrival window, and may also return an adjusted periodicity. §5.27.2.5.1

Q22.6 Which four parameters configure hold-and-forward buffering in a translator?

• 5QI, ARP, MDBV and GFBR
• AdminControlList, AdminBaseTime, AdminCycleTime and TickGranularity
• Only the priority value in the VLAN tag

Those four give the externally visible behaviour of scheduled traffic with protected windows, so only one transmission gate is ever open. §5.27.4

Q23.1 A device sets up two redundant PDU sessions. What tells the radio network that those two belong together?

• The RSN
• The PDU Session Pair ID
• The QFI

The PDU Session Pair ID identifies the two sessions as a pair; the RSN is what tells them apart, so the radio gives each one different user plane resources. §5.33.2.1

Q23.2 With two N3 tunnels carrying the same QoS Flow, how does the receiver throw away the copy?

• By the GTP-U sequence number, which the sender puts on both copies
• By a timer that drops anything arriving twice within a millisecond
• By comparing the payloads byte for byte

The sender replicates the packet and gives both copies the same GTP-U sequence number; the receiver eliminates on that number, and no reordering is required. §5.33.2.2

Q23.3 What must a PCC rule carry before the radio will do PDU Set based QoS handling?

• All three of PSDB, PSER and PSIHI
• A PDU Set Size in bytes
• A PSIHI, or both a PSDB and a PSER

At least a PSIHI, or at least both a PSDB and a PSER, has to be sent. The PDU Set Size is carried per packet in the GTP-U header, not agreed in a rule. §5.7.7.1

Q23.4 When the anchor UPF does the ECN marking for L4S, where does it learn that the radio is congested?

• It measures its own queue
• The NG-RAN reports a percentage to it in a GTP-U header extension
• The application server tells it over N6

The radio reports the percentage of packets the UPF should mark; if there is no uplink packet to carry the report, the radio may make a dummy one. §5.37.3.3

Q23.5 Why would an application server put media information into a UDP option on the way to the UPF?

• Because the media itself is encrypted end to end, so the UPF cannot find the frame boundaries
• Because UDP options are faster to parse than RTP headers
• To save bandwidth on N6

The inner datagram is the encrypted packet between server and device; the outer one carries the media information the UPF would otherwise have had to read out of the payload. §Annex W

Q24.1 What identifies a stand-alone non-public network?

• A Closed Access Group Identifier
• A NID on its own
• A PLMN ID together with a NID

The combination of a PLMN ID and a Network identifier names the SNPN. Neither half is required to be unique on its own. §5.30.2.1

Q24.2 A device registers in an SNPN whose NID came from coordinated assignment, and there is no subscription for it. What does the AMF do?

• Rejects it so that it will not pick that SNPN again for a while
• Accepts it in limited service state
• Rejects it so that it will not automatically pick that SNPN again, permanently

A coordinated NID is meant to be unique, so the refusal can be trusted forever. With a self-assigned NID the bar is only temporary, because the same NID may belong to a different network elsewhere. §5.30.2.5

Q24.3 A device camped in an SNPN wants a service from a public network. What role does the SNPN play towards that public network?

• A radio access network of the public network
• Untrusted non-3GPP access
• A roaming partner

The device registers a second time with the public network over the SNPN user plane, reaching an N3IWF, exactly as it would over a café Wi-Fi. §5.30.2.7

Q24.4 How many 5G VN groups can one PDU session reach?

• As many as share the DNN
• Any number, chosen per packet
• One

A PDU session provides access to one and only one 5G VN group, and a group is tied to a single DNN and S-NSSAI combination. §5.29.3

Q24.5 Which element of a Personal IoT Network carries the traffic to the 5G network?

• Any PINE, directly
• The PEMC
• The PEGC

The PEGC is the gateway and is a UE with PIN subscription data. The PEMC manages the network and is otherwise an ordinary UE. §5.44.1

Q24.6 What stops a device from resuming a connection in a Closed Access Group cell it is not allowed in?

• The UDM refuses the subscription lookup
• The NG-RAN rejects the RRC Resume, from the Allowed CAG list it holds
• Nothing — CAG only affects idle-mode cell selection

The Allowed CAG list travels to NG-RAN inside the Mobility Restrictions, so the radio network can refuse a resume or a handover without asking the core. §5.30.3.4

Q25.1 In Control Plane CIoT 5GS Optimisation, where does the user's data ride?

• In an SMS
• In a data radio bearer, as usual, but compressed
• As the payload of a NAS message, between the UE and the SMF

The point of the optimisation is that no user-plane connection is set up for the PDU session at all; the data travels inside signalling. §5.31.4.1

Q25.2 Serving PLMN Rate Control is expressed in which unit?

• X NAS Data PDUs per deci hour, with X never less than 10
• Packets per day, taken from the subscription
• Kilobits per second, uplink and downlink together

A deci hour is a tenth of an hour, six minutes. The limits are separate for uplink and downlink and configured in the (V-)SMF. §5.31.14.2

Q25.3 Which control exists so an operator can sell "a maximum of Y messages per day"?

• Session-AMBR
• Serving PLMN Rate Control
• Small Data Rate Control

Small Data Rate Control is the home network's tool. Serving PLMN Rate Control protects the visited network's own AMF and signalling bearers. §5.31.14.1

Q25.4 Which PDU sessions may the Reliable Data Service be used with?

• Any unstructured session, control plane or user plane
• Only sessions marked Control Plane Only, or ones using the control-plane optimisation that the AMF does not move to the user plane
• Only sessions anchored in the NEF

The restriction exists so that one instance of the service never has to straddle the user plane and the control plane at the same time. §5.31.6

Q25.5 How many PDU sessions can have active user-plane resources at once over NB-IoT?

• Two
• As many as the subscription allows
• One

NB-IoT supports a maximum of two data radio bearers, and the mapping from the single QoS Flow of a session to a bearer is one-to-one. §5.31.19

Q25.6 When is the Service Gap timer started?

• Each time the UE moves from CM-CONNECTED to CM-IDLE, unless the connection answered paging for a mobile-terminated event, or followed a mobility or periodic registration with no follow-on request and no uplink data status
• When the UE's rate control allowance runs out
• When the UE registers

A connection the network asked for does not cost the UE its next turn, and neither does a bare registration; one the UE started to send something does. §5.31.16

Q26.1 An IAB node relays traffic for the base station above it. At which layer, and what does that save?

• At the application layer, inside a PDU session
• At layer 3, so a local UPF is needed at every hop
• At layer 2, so no local UPF is needed and the relaying is invisible to the core

IAB relays at layer 2 and the F1 interface between donor and node is not visible to the 5GC, so no user-plane function sits in the relay. §5.35.1

Q26.2 A MWAB is a gNB on a vehicle. What carries its N2, N3 and Xn traffic back to the core?

• A dedicated satellite link outside the scope of 3GPP
• A layer-2 backhaul link, as with IAB
• Backhaul PDU sessions established by the MWAB's own UE component

The MWAB-UE registers and establishes PDU sessions like any device, and the gNB's interfaces ride over the IP or Ethernet connectivity they give. §5.49.1.1

Q26.3 What does a mobile base station relay send when it establishes its RRC connection?

• The mobile IAB-indication, and not the IAB-indication
• Both indications, so either kind of AMF can serve it
• The IAB-indication, the same as a fixed IAB node

The mobile IAB-indication makes the donor pick an AMF that can authorise a mobile node; sending the plain IAB-indication as well is forbidden. §5.35A.1

Q26.4 The AMF tells the SMF that the backhaul category is DYNAMIC_LEO. What does the word "dynamic" add?

• The latency or bandwidth of the backhaul changes over time
• More than one category applies at once
• The satellite is moving relative to the ground

Dynamic categories mean the capabilities of the backhaul vary, for example because inter-satellite links change; only one category is ever indicated. §5.43.4

Q26.5 What does the NR RedCap indication actually give the core?

• A RAT type it stores and passes on, so traffic from such devices can be told apart
• A slice reserved for cheap devices
• A quality-of-service profile with a lower bit rate

The indication travels from the radio to the AMF, which treats it as the RAT type and signals it onward, for example for charging differentiation. §5.41

Q26.6 A PDU session is served by an SMF and an inserted I-SMF. Which of the two talks to the PCF and the charging function?

• The I-SMF, because it is closer to the device
• The SMF, which keeps those interfaces
• Both, each for the part of the path it controls

The I-SMF controls the user-plane functions the SMF cannot reach, but the SMF stays the network function with the PCF and CHF interfaces. §5.34.1

Q27.1 What does an overloaded AMF send to make the radio network turn phones away?

• An NGAP OVERLOAD START message to some or all of its radio nodes
• A deregistration request to the NRF
• A NAS back-off timer to every phone in the area

N2 overload control is the AMF invoking the overload procedure towards all or a proportion of the radio nodes it has N2 connections with, and it may carry a percentage of requests to restrict. §5.19.5.2

Q27.2 A Mobility Management back-off timer is running in a phone. Which of these is it still allowed to start?

• A periodic registration update
• A deregistration
• Any session management request for a different data network

While the timer runs the phone starts no NAS request except deregistration and procedures not subject to congestion control, and after such a deregistration the timer keeps running. §5.19.7.2

Q27.3 Why does the specification tell the core to pick a different back-off value for each phone?

• Because each phone has a different subscription class
• So that the deferred requests do not all arrive again at the same moment
• Because the timer is capped at 60 seconds per phone

Identical timers would make a large number of phones retry almost simultaneously, which recreates the storm the timer was meant to break. §5.19.7.1

Q27.4 An AMF is being taken out of service and there is no UDSF in the network. What happens to the contexts of the phones it serves?

• They are dropped, and every phone re-registers
• They stay in the old AMF until its last phone goes idle
• They are forwarded to target AMFs in the same AMF set, grouped by GUAMI

Without a UDSF the AMF forwards registered UE contexts, grouped by the same GUAMI value, to target AMFs within the same AMF set, and then deregisters itself from the NRF. §5.21.2.2.2

Q27.5 A user switches on 3GPP PS Data Off. What still gets through?

• Nothing at all until it is switched off again
• Only the operator's exempt services, and anything over non-3GPP access
• Only traffic on the default PDU session

The feature blocks IP, Unstructured and Ethernet traffic via 3GPP access except the 3GPP PS Data Off Exempt Services, and the status of a PDU session does not affect transfer over non-3GPP access. §5.24

Q27.6 Which function works out how much energy one phone, slice or session consumed?

• The NWDAF
• The Energy Information Function
• The charging function

The EIF collects the inputs, calculates consumption at UE, S-NSSAI, PDU session and service data flow granularity, and exposes the result to authorised consumers. §5.51.2.1