Which two statements about the fragmentation of IPsec packets in routers are true? (Choose two.)

[answerhappygod]

Which two statements about the fragmentation of IPsec packets in routers are true? (Choose two.)

A. By default, the IP packets that need encryption are first encrypted with ESP. If the resulting encrypted packet exceeds the IP MTU on the egress physical interface, then the encrypted packet is fragmented and sent out.
B. By default, the router knows the IPsec overhead to add to the packet. The router performs a lookup if the packet will exceed the egress physical interface IP MTU after encryption, then fragments the packet and encrypts the resulting IP fragments separately.
C. increases CPU utilization on the decrypting device.
D. increases CPU utilization on the encrypting device.