Which statement about GETVPN is true?

The GETVPN key server is the authoritative source of policy - it defines the access control list specifying which traffic to encrypt and pushes this policy along with the Traffic Encryption Keys (TEKs) to all registered group members. Group members apply the policy received from the key server rather than configuring encryption policy locally.

In a COOP key server configuration, one key server is elected primary and performs all rekeys while the secondary is a hot standby that only takes over if the primary fails - TEK rekeys are not load-balanced between the two.

GETVPN anti-replay uses a pseudotime value distributed by the key server to group members as part of the Group SA, making it independent of NTP and not synchronized via NTP.

GETVPN supports both unicast and multicast rekey methods - multicast rekey does not require acknowledgment from group members, so whether acknowledgment is required depends on the configured rekey transport method.