When should ssh host keys be replaced?

When should ssh host keys be replaced? (Choose two.)

A.
never

B.
once a year if 4096 bit keys are used

C.
when a server has been compromised

D.
as soon as a vulnerability is found in sshd

E.
as dictated by the organization’s security policy