Which two options are possible for authenticating the clients that do not have an 802, IX supplicant while deploying 802.IX authentication on Cisco Catalyst switches?

Which two options are possible for authenticating the clients that do not have an 802, IX supplicant
while deploying 802.IX authentication on Cisco Catalyst switches?
(Choose two.)

A.
MAC Authentication Bypass

B.
Protected EAP

C.
Active Directory Single Sign-On

D.
web authentication