What is not a difference between VPN tunnel authentication and per-user authentication?（）

A、VPN tunnel authentication is part of the IKE specification. 

B、VPN tunnel authentication does not control which end user can use the IPSec SA (VPN tunnel).

C、User authentication is used to control access for a specific user ID, and can be used with or without a VPN tunnel for network access authorization. 

D、802.1X with EAP-TLS (X.509 certificates) can be used to authenticate an IPSec tunnel.