Which two statements about the EAP-FAST client-server authentication protocol are true?

Which two statements about the EAP-FAST client-server authentication protocol are true? (Choose two.)

A.
EAP-FAST establishes secure tunnel between the client and the server using certificates.

B.
PAC can be distributed manually (out-of-band provisioning) or automatically (in-band provisioning).

C.
EAP-FAST protocol uses PAC keys to establish secure encrypted tunnels between client and server.

D.
Secure passwords are used to generate PAC key for creating secure TTLS tunnel between the client and the server.