Which statement about MACsec is true?

Which statement about MACsec is true?

A.
MACsec provides Layer 2 hop-by-hop encryption, based on the 802.1AE standard.

B.
Cisco AnyConnect Release 3.0 supports both roles: supplicant and authenticator.?

C.
802.1X protection includes the CMD field, which is used to carry the security group tag value.

D.
MACsec does not work between any MACsec-capable supplicant and authenticator.