For FortiGate devices equipped with Network Processor (NP) chips, which are true? (Choose three.)

A.
For each new IP session, the first packet always goes to the CPU.

B.
The kernel does not need to program the NPU. When the NPU sees the traffic, it determines by itself whether it can process the traffic

C.
Once offloaded, unless there are errors, the NP forwards all subsequent packets. The CPU does not process them.

D.
When the last packet is sent or received, such as a TCP FIN or TCP RST signal, the NP returns this session to the CPU for tear down.

E.
Sessions for policies that have a security profile enabled can be NP offloaded.