Which statement about MACsec is true?

A.
MACsec does not work between any MACsec-capable supplicant and authenticator.

B.
MACsec provides Layer 2 hop-by-hop encryption, based on the 802.1AE standard.

C.
802.1X protection includes the CMD field, which is used to carry the security group tag value.

D.
Cisco AnyConnect Release 3.0 supports both roles: supplicant and authenticator.

Explanation:

http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/15.1/XE_330SG/configuration/guide/
swmacsec.html