Which two statements about IPsec VTI implementation are true?

Which two statements about IPsec VTI implementation are true? (Choose two.)

A.
The IKE SA can be bound to the VTI and the crypto map.

B.
The transform set can be configured only in tunnel mode.

C.
SVTIs support only a single IPsec SA.

D.
SVTIs support IPv4 packets that carry IPv6 packets.