Which two statements are true about route-based IPsec VPNs on an SRX Series device?

Which two statements are true about route-based IPsec VPNs on an SRX Series device? (Choose two)

A.
Route-based VPNs must use IKE aggressive mode.

B.
New tunnels are generated with each new flow of traffic.

C.
An st0 interface must be bound to each VPN.

D.
A security policy must permit the traffic.