Which three statements about dot1Q trunking are true? (Choose three)

A trunk port can function as a tunnel port, such as in QinQ (802.1Q Tunneling) scenarios, where it encapsulates customer VLAN tags within a service provider's VLAN tag for transport.

The default `switchport mode` on many Cisco switches is `dynamic auto`, not `dynamic desirable`, which actively attempts to form a trunk.

Port security, which defines a 'secure port', is typically configured on access ports to control MAC addresses, not on trunk ports which carry traffic for multiple VLANs.

While Dynamic Trunking Protocol (DTP) allows negotiation of trunking, the encapsulation type (dot1Q or ISL) is generally explicitly configured or implicitly defaults to dot1Q on modern switches, rather than being negotiated by default between different encapsulation types.

IEEE 802.1X authentication is designed for authenticating end devices on access ports and cannot be enabled on a trunk port, resulting in a configuration error.

On many Cisco Catalyst switches, the default `switchport mode` for an Ethernet interface is `dynamic auto`, meaning it passively waits for the neighboring port to initiate trunking.