Which of the following statements regarding the Secure Sockets Layer (SSL) security model are true? Each correct answer represents a complete solution. Choose two.

Server authentication in SSL/TLS is mandatory, not optional - the client must always validate the server's certificate as part of the standard handshake.

In the SSL/TLS handshake, server authentication is always required - the server must present a digital certificate that the client validates against a trusted CA, ensuring the client knows it is communicating with a legitimate server. This is a non-negotiable part of the protocol design to prevent man-in-the-middle attacks.

Client authentication is never required by default in SSL/TLS - the server can only optionally request it, and many deployments never enable it.

Client authentication in SSL/TLS is an optional extension known as mutual TLS (mTLS). The server may request a client certificate during the handshake, but this step can be skipped, making it optional from the server's perspective.