Which two statements are true about route-based VPNs?

Which two statements are true about route-based VPNs? (Choose two.)

A.
Route-based VPNs cannot be used to configure remote access or dialup VPNs.

B.
The from-zone and to-zone, for a security policy to permit traffic over a route-based VPN, are derived from
the zone in which the protected network lies and the zone in which the IKE interface lies.

C.
system services ike must be enabled on the st0.x interface.

D.
You cannot re-write the DSCP bits on the inner IP header of an ESP packet that was created or forwarded
using a route-based VPN.