Which two firewall user authentication objects can be referenced in a security policy?

Which two firewall user authentication objects can be referenced in a security policy?
(Choose two.)

A.
access profile

B.
client group

C.
client

D.
default profile