Which two statements describe the security policy attachment features of Oracle SOA Suite 11g?

Which two statements describe the security policy attachment features of Oracle SOA Suite
11g?

A.
The order in which policies are attached to a subject determines the order in which
the policies are executed.

B.
JDeveloper groups the policy that can be attached into the five categories of
interceptors.

C.
Only one security polity can be attached to a web service at a time.

D.
In JDeveloper, a security policy can be attached to a web service, but it can be
marked as either enabled or disabled.