Which two statements are true regarding firewall user authentication?

Which two statements are true regarding firewall user authentication? (Choose two.)

A.
When configured for pass-through firewall user authentication, the user must first open a connection to the Junos security platform before connecting to a remote network resource.

B.
When configured for Web firewall user authentication only, the user must first open a connection to the Junos security platform before connecting to a remote network resource.

C.
If a Junos security device is configured for pass-through firewall user authentication, new sessions are automatically intercepted to perform authentication.

D.
If a Junos security device is configured for Web firewall user authentication, new sessions are automatically intercepted to perform authentication.