Explanation/Reference:
B: Because secure transport was built taking hybrid networking into account, you can configure a private and public IP address. The public IP address relies on reachability over a network marked Public. This configurations allows the controller to first be reached over the private network and then the public network.
C: The management plane is configured on the SCC using SSL and SSH secured communications, in which you create and distribute the path selection policy. When a network is marked as securable, it indicates that the SteelHead will join a group of other SteelHeads that can encrypt traffic. The SCC pushes the path selection policy to all the SteelHeads.
Incorrect:
Not D: The configurations allows the controller to first be reached over the private network and then the public network. The private and public IP addresses do not need to come from the same in-path interface.
With the stp-client controller in-path enable command, the data center SteelHead (DC-SH) uses the private and public IP addresses from the same in-path interface, while the branch office SteelHead (BR-SH) uses the private and public IP addresses from different in-path interfaces.
References: https://support.riverbed.com/bin/support/static/mcmq1o68fbs27lqc5798c4p8m6/html/ ak9u1115aieef8qcb43mjgf98d/scc_9.2_dg_html/index.html#page/scc_deploy_9.2/secure_transport.html