Which two configuration elements are required for a policy-based VPN?

Which two configuration elements are required for a policy-based VPN? (Choose two.)

A.
IKE gateway

B.
secure tunnel interface

C.
security policy to permit the IKE traffic

D.
security policy referencing the IPsec VPN tunnel