Which two statements about EAP-FAST operation are true when the Cisco Secure ACS is configured to support anonymous in-band PAC provisioning? (Choose two.)

A.
An anonymousDiffie-Hellman TLS handshake will be used between the wireless client and the Cisco Secure ACS.

B.
A digital certificate will be required on the client and on the Cisco Secure ACS.

C.
EAP-MSCHAP will be used as the only inner method in phase zero to authenticate the client.

D.
Cisco Secure ACS will provision the wireless client with a PAC using a TLS tunnel.

E.
Cisco Secure ACS will verify the user identity by doing a binary comparison of the end-user certificate to the user certificate stored in Active Directory.