Which two options regarding the Cisco TrusSec Security Group Tag are true? (Choose Two.)

A.
It is assigned by the Cisco ISE to the user or endpoint session upon login.

B.
Best practice dictates it should be statically created on the switch

C.
It is removed by the Cisco ISE before reaching the endpoint

D.
Best Practice dictates that deployments should include a guest group allowing access to minimal

E.
Best Practice dictates that deployments should include a security group for common services such as DNS and DHCP