A. It authenticates users via a cloud-based service and refers to the hub for mappings for group identification.

B. It allows configuration of an authentication source once instead of for each authentication method.

C. It expands the capability to filter and forward decrypted and non-decrypted Transport Layer Security (TLS) traffic.

D. It ensures that a compromised master key does not compromise the configuration encryption for an entire deployment.