Which two statements are true about IPsec traffic?

Which two statements are true about IPsec traffic? (Choose two.)

A.
IPsec traffic can be forwarded when no IKE SA is present.

B.
IPsec traffic can be forwarded when no IPsec SA is present.

C.
For traffic that has to be encrypted, the security policy must be crafted based on the IP addresses in the inner IP header of the final ESP packet.

D.
For traffic that has to be encrypted, the security policy must be crafted based on the IP addresses in the outer IP header of the final ESP packet.