Which two statements about EAP-FAST operation are true when the Cisco Secure ACS is configured to support anonymous in-band PAC provisioning? (Choose two.)
A.
An anonymousDiffie-Hellman TLS handshake will be used between the wireless client and the Cisco Secure ACS.
B.
A digital certificate will be required on the client and on the Cisco Secure ACS.
C.
EAP-MSCHAP will be used as the only inner method in phase zero to authenticate the client.
D.
Cisco Secure ACS will provision the wireless client with a PAC using a TLS tunnel.
E.
Cisco Secure ACS will verify the user identity by doing a binary comparison of the end-user certificate to the user certificate stored in Active Directory.