which two of these statements are correct?

When implementing a web authentication-based WLAN, which two of these statements are
correct? (Choose two.)

A.
When using an external web authentication server, a pre-auth ACL is required for the WLC
5500.

B.
You need to configure DNS resolution for the IP address of the Cisco WLC virtual interface.

C.
When using the Cisco WLC as a web auth server, wireless clients will never be able to validate
the Self Signed Certificate (SCC) so a Locally Significant Certificate (LSC) must be used.

D.
If you are using an external web server for the login portal, wireless clients may be required to
trust two certificates: one from the external web server and one from the Cisco WLC.