Which two statements are correct about processing traffic entering an IPSec tunnel on an SRX Series device?

Which two statements are correct about processing traffic entering an IPSec tunnel on an SRX Series device?
(Choose two)

A.
A new IP header is added to the encrypted packet

B.
Only the payload of the original packet is encrypted.

C.
Security policies are evaluated before the route lookup.

D.
The original IP packet is encrypted