Which two statements are true concerning policy-based IPsec VPNs on an SRX Series device? (Choose two)
A.
A new tunnel is set up for each flow of traffic that matches the policy.
B.
One tunnel is set up for all flows of traffic that match the policy.
C.
A new tunnel is set up before a flow of traffic matches the policy.
D.
A new tunnel is set up only when a flow of traffic matches the policy.