Which two statements are true when designing a SSL VPN solution using Cisco AnyConnect? (Choose two.)

A self-signed certificate is not required - Cisco best practice requires a CA-signed certificate on the ASA to prevent client trust warnings, and self-signed certs are discouraged in production AnyConnect deployments.

SSL group pre-shared keys are not part of AnyConnect SSL VPN design - pre-shared keys are used in IPsec IKE phase 1 negotiations and have no equivalent role in SSL/TLS-based VPN connections.

The server-side certificate is not optional even when AAA handles client authentication - TLS requires the server to present a certificate to complete the SSL handshake regardless of the client authentication method selected.

The VPN IP address pool can overlap with existing LAN networks because the AnyConnect client uses a virtual adapter and the ASA headend handles routing through the tunnel interface, so layer-3 address overlap between the pool and internal ranges does not cause a fundamental connectivity failure.

DTLS (Datagram TLS) uses UDP as its transport and can be enabled alongside standard TLS to reduce latency and improve throughput, particularly for real-time and latency-sensitive applications, making it a valid and recommended design choice for performance optimization.