Which two statements about certificate-based authentication are true?

Which two statements about certificate-based authentication are true? (Choose two.)

A.
Certificate-based user authentication requires OCSP with CRL as a backup.

B.
Certificate-based user authentication requires CRL.

C.
Certificate-based authentication might require user input during the login process.

D.
Certificate attributes can be used to assign users to roles.