Which two options regarding the Cisco TrustSec Security Group Tag are true?

A.	Best Practice dictates that deployments should include a guest group allowing access to minimal services.
B.	Best Practice dictates that deployments should include a security group for common services such as DNS and DHCP.
C.	Best Practice dictates it should be statically created on the switch.
D.	It is assigned by the Cisco ISE to the user or endpoint session upon login.
E.	It is removed by the Cisco ISE before reaching the endpoint.