Which two statements are true about route-based VPNs?

Which two statements are true about route-based VPNs? (Choose two.)

A.
Route-based VPNs cannot be used to configure remote access or dialup VPNs.

B.
The from-zone and to-zone, for a security policy to permit traffic over a route-based VPN, are
derived from the zone in which the protected network lies and the zone in which the IKE interface
lies.

C.
system services ike must be enabled on the st0.x interface.

D.
You cannot re-write the DSCP bits on the inner IP header of an ESP packet that was created or
forwarded using a route-based VPN.