What is NOT true with pre shared key authentication within IKE/IPsec protocol:

A.
pre shared key authentication is normally based on simple passwords

B.
needs a PKI to work

C.
Only one preshared key for all VPN connections is needed

D.
Costly key management on large user groups