Every question of this course

Q1.1 Which stage of a 3GPP specification is TS 23.501?

• Stage 2, how the system is put together
• Stage 3, what goes on the wire
• Stage 1, what the system must do

The first line of the scope says the document defines the Stage 2 system architecture for the 5G System. Message formats are stage 3 and live elsewhere. §1

Q1.2 A colleague says "the service bus in figure 4.2.3-1". What is wrong with that?

• Nothing, it is the message bus the core runs on
• The bar is not a bus; it means these functions offer services any authorized function may call
• It is a bus, but only for user data

The service-based drawing shows every control plane function offering services on one line. There is no shared bus underneath it, only calls from one function to another. §4.2.1

Q1.3 The 5G core is drawn twice, once with a horizontal bar and once as a graph of labelled links. What is the relationship between the two?

• They are two networks an operator chooses between
• They are two views of one network, and the service-based one is the binding rule
• The graph is older and no longer used

Clause 4.2.1 says control plane functions shall only use service-based interfaces. The reference point drawing labels those same conversations, so it is a view, not an alternative. §4.2.1

Q1.4 Where does the packet a phone sends actually get out of the mobile network?

• At the AMF
• At the UPF, over N6, into a Data Network
• At the (R)AN

The user plane stack shows the payload tunnelled from the radio node to a UPF over N3, and the UPF is the point of interconnect to the Data Network. §8.3.1

Q1.5 Which two documents does the scope name as companions to TS 23.501?

• TS 23.502 and TS 23.503
• TS 33.501 and TS 32.240
• TS 38.300 and TS 38.401

The scope names TS 23.502 for the stage 2 procedures and flows, and TS 23.503 for the stage 2 policy control and charging architecture. §1

Q2.1 A device moves to a new tracking area and the network has to know where it is. Which function's job is that?

• The SMF
• The AMF
• The UPF

Registration, connection, reachability and mobility management are all in the AMF's list. The SMF handles sessions, the UPF forwards packets. §6.2.1

Q2.2 How many NAS interface instances exist per access network between a device and the core?

• One per PDU session
• One, terminated at a function that does at least NAS security and mobility management
• One per network function the device talks to

The note under the AMF's list says there is only one NAS interface instance per access network, regardless of how many network functions there are. §6.2.1

Q2.3 What is the difference between the UDR and the UDSF?

• The UDR holds data whose structure 3GPP defines; the UDSF holds data whose structure it does not
• The UDSF is the newer name for the UDR
• The UDR is for the home network, the UDSF for the visited network

The UDR holds standardised sets — subscription, policy, exposure, application and Ambient IoT data. The UDSF holds unstructured data such as a UE context. §4.2.5

Q2.4 What does the specification call the SCP and the SEPP?

• Network entities, in a second list after the network functions
• Access network nodes
• Network functions, like the AMF and the SMF

The list of network functions ends, and a second list opens with "also comprises the following network entities". The SCP and the SEPP are on that one. §4.2.2

Q2.5 An outside application wants a QoS change for one subscriber and is not trusted to call the core directly. Which way in does the document give it?

• Through the NEF
• Through the NRF
• Straight to the PCF over N5

Application Functions the operator does not allow to reach network functions directly use the external exposure framework via the NEF. §6.2.10

Q3.1 What does the name "Nsmf" stand for?

• The link between the SMF and the UPF
• The service-based interface the SMF offers to others
• The protocol the SMF speaks to the radio network

A name of the form N plus a lower-case function name is the interface that function exhibits — the set of services it offers. It belongs to one function, not to a pair. §4.2.6

Q3.2 Which of these is a genuine point-to-point link rather than a label for service calls?

• N11, between the AMF and the SMF
• N7, between the SMF and the PCF
• N4, between the SMF and the UPF

N1, N2, N3, N4, N6 and N9 are listed before the sentence that says the rest are realized by service-based interfaces. Those six are their own links. §4.2.7

Q3.3 A function wants to be told whenever something changes rather than asking repeatedly. Which mechanism is that?

• Subscribe-notify
• Delegated discovery
• Request-response

The framework has exactly two mechanisms. Subscribe-notify carries a notification endpoint so the producer knows where to send the result. §7.1.2

Q3.4 How does the NRF know which functions exist?

• It scans the network for them
• Each instance informs it of the services it supports, or an authorised entity does so on its behalf
• The operator loads a file into it

Each NF instance registers its list of services with the NRF, and de-registers on a controlled shutdown. Another authorised entity may do it instead, and must if the instance crashes. §7.1.5

Q3.5 In indirect communication, who may do the looking-up?

• Always the consumer
• Either the consumer, or the SCP on the consumer's behalf
• Always the NRF

The consumer may be configured to discover the producer itself, or to delegate the discovery to the SCP it is using. §7.1.1

Q4.1 A phone is registered but has nothing to send. Which pair of states is it in?

• RM-REGISTERED and CM-CONNECTED
• RM-REGISTERED and CM-IDLE
• RM-DEREGISTERED and CM-IDLE

Registration and connection are separate state machines. Registered with no signalling connection is the ordinary resting state of a phone in a pocket. §5.3.3.2.2

Q4.2 What does a device send instead of its permanent subscriber identity when it first contacts a network?

• The PEI
• The SUCI, the concealed form of the SUPI
• The 5G-GUTI it was given by a different operator

The subscriber identity is provided in concealed form. The SUCI is the privacy-preserving identifier that contains the concealed SUPI. §5.9.2

Q4.3 Why does the AMF have to spread the ten least significant bits of the 5G-TMSI evenly?

• Because they are the checksum of the identifier
• Because they encode the tracking area
• Because the radio network uses them to decide at what moment a device is paged

The NG-RAN uses those ten bits to work out the paging occasion, so an uneven allocation would crowd many devices into the same moment. §5.9.4

Q4.4 What is a registration area, in practice?

• The single cell the device last used
• The list of tracking areas the AMF gave the device, inside which it need not report a move
• The whole country the operator serves

The AMF allocates a set of tracking areas as a TAI list. The device only performs a Mobility Registration Update when its current tracking area is not on that list. §5.3.2.3

Q4.5 A device has asked for MICO mode and is in CM-IDLE. What happens to a downlink packet for it?

• It is paged as usual
• The AMF treats it as unreachable and rejects the request for downlink delivery
• It is delivered over non-3GPP access instead

In MICO mode the AMF considers the device always unreachable while it is CM-IDLE, and rejects requests for downlink data delivery with a cause. §5.4.1.3

Q5.1 What is the finest thing a 5G network can give a separate quality treatment to?

• A PDU session
• A QoS Flow
• A single packet

Every packet marked with the same QFI inside a session gets the same forwarding treatment, so the flow is the unit — not the session and not the packet. §5.7.1.1

Q5.2 Which of these can be changed after a PDU session has been established?

• The data network name
• The S-NSSAI of the serving network
• The PDU session type

The table of session attributes marks the serving network's S-NSSAI as modifiable, because the device may move to a different network. DNN, type, SSC mode and session id are fixed. §5.6.1

Q5.3 A session is set to SSC mode 3. What does the device experience when the anchor changes?

• Nothing at all; the address is preserved
• A new connection is established before the old one is torn down, and the IP address is not preserved
• The session is released and the device has to start again

SSC mode 3 makes the user plane change visible, but sets up the new anchor before releasing the old one so connectivity is not lost. The address does not survive the change. §5.6.9.1

Q5.4 What is a 5QI?

• The identifier of a QoS Flow inside a session
• A bandwidth in megabits per second
• A pointer into a set of QoS characteristics such as priority, delay budget and error rate

The 5QI is a scalar that references the 5G QoS characteristics. The identifier of a flow inside a session is the QFI. §5.7.2.1

Q5.5 An uplink packet matches no QoS rule in the device. What happens to it?

• It goes on the default flow
• The device discards it
• It is sent unmarked and the UPF classifies it

The device evaluates uplink packets against the rules in order of precedence, and if no rule matches it discards the packet. §5.7.1.5

Q5.6 Who tells the UPF how to detect, forward, police and report traffic?

• The radio network, over N3
• The PCF, directly
• The SMF, over N4

The SMF selects and controls the user plane function. It gives the UPF packet detection rules and the treatment that goes with each of them. §5.8.1

Q6.1 What is an S-NSSAI made of?

• A data network name and a session type
• A slice/service type, and optionally a slice differentiator
• A country code and a network code

The S-NSSAI identifies a slice. The SST says what kind of behaviour is expected; the optional SD tells apart several slices of the same kind. §5.15.2.1

Q6.2 Can two network slice instances share one PDU session?

• No, a session belongs to one and only one slice instance per network
• Yes, when the device is roaming
• Yes, if they have the same SST

The clause says a PDU session belongs to one and only one slice instance per network, though different slices may have their own sessions to the same data network name. §5.15.1

Q6.3 How many S-NSSAIs may an Allowed NSSAI carry in signalling between the device and the network?

• As many as the subscription holds
• Sixteen
• Eight

At most eight in the Allowed NSSAI and in the Requested NSSAI. Sixteen is the number of Subscribed S-NSSAIs the UDM may send to the AMF. §5.15.2.1

Q6.4 A device is served by three slices at once. How many AMFs serve it?

• One, and it logically belongs to each of the slice instances serving the device
• One per slice, plus a coordinating one
• One per slice

The AMF instance serving the device logically belongs to each of the slice instances serving it, so it is common to all of them. §5.15.1

Q6.5 Where is the policy and charging control framework for 5G actually defined?

• In TS 23.503
• In TS 33.501
• In clause 5.14 of this document

Clause 5.14 is one sentence long and names TS 23.503. This document says who holds policy, not what a policy rule contains. §5.14

Q6.6 The user plane security enforcement for a session says integrity protection is "Preferred". What does that mean?

• It shall apply to all traffic on the session
• It should apply to all traffic on the session
• It shall not apply

The three values are Required (shall), Preferred (should) and Not Needed (shall not). The setting is fixed for the life of the session. §5.10.3

Q7.1 In home-routed roaming, where does the traffic leave the mobile network?

• In the home network
• Wherever the device asks
• In the visited network

Home-routed means the session is anchored on a UPF under the home operator's control. Local breakout is the other case, where the visited operator holds the SMF and every UPF. §5.6.3

Q7.2 What sits between two operators' control planes?

• An SCP
• A SEPP at each end, over N32
• An NRF shared by both

The SEPP is a non-transparent proxy that filters and polices every inter-network control plane message and hides the topology behind it. §6.2.17

Q7.3 A Wi-Fi network the operator does not trust is used to reach the 5G core. What does the traffic pass through?

• An N3IWF
• A W-AGF
• A TNGF

An untrusted non-3GPP access network connects through an N3IWF; a trusted one connects through a TNGF. Both face the core over N2 and N3. §4.2.8.1

Q7.4 What does a device in single-registration mode hold?

• Two independent registrations over separate radio connections
• One active mobility management state, either in 5G or in 4G
• One state in each, kept in step

Single-registration mode means one active state and one coordinated registration, with the temporary identity mapped between the two systems. Dual-registration mode is the other case. §5.17.2.1

Q7.5 Which of these is a way the core supports edge computing?

• Moving the AMF to the edge
• Giving the device a second subscription
• Selecting a UPF close to the device and steering traffic to a local part of the data network

The enablers listed are user plane reselection, local routing and traffic steering, session continuity, application function influence, exposure, policy and local area data networks. §5.13

Q7.6 An outside party wants to be told when a device becomes reachable. Which exposure category is that?

• Monitoring
• Analytics reporting
• Provisioning

Monitoring covers mobility management context such as location, reachability, roaming status and loss of connectivity, reported to an authorised outside party through the NEF. §5.20