When does the ProxySG require the use of BCAAA with an IWA realm?

A.
When using Kerberos credentials.

B.
When your organization does not permit the ProxySG to join the Windows domain of the
authentication server.

C.
When you are using two or more IWA realms on the same ProxySG.

D.
When you are performing SSL interception.

Explanation:
https://bto.bluecoat.com/sgos/ProxySG/63/AuthMobileGuide/Content/Topics/Authentica
tion/Tasks/IWA/IWA_BCAAA_st.htm