ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Because the organization cannot trust the radio access network, it must add an end-to-end cryptographic layer that is independent of the cellular provider. Establishing an IPsec VPN tunnel from each terminal to the processing environment encrypts every packet and provides integrity checking from the source device all the way to the data-center gateway. Even if an IMSI catcher forces the terminal to attach to a rogue base station, the attacker sees only ciphertext and cannot tamper with the traffic without detection. Enabling carrier features such as Carrier Aggregation or static APN credentials does nothing to protect the data itself, and turning off LTE encryption exposes the payload in clear text, increasing risk rather than reducing it.