Which statement about MACsec is true?

Which statement about MACsec is true?

A.
MACsec does not work between any MACsec-capable supplicant and authenticator.

B.
802.1X protection includes the CMD field, which is used to carry the security group tag
value.

C.
MACsec provides Layer 2 hop-by-hop encryption, based on the 802.1AE standard.

D.
Cisco AnyConnect Release 3.0 supports both roles: supplicant and authenticator?