Which statements about IP-based explicit proxy authentication are true? (Choose two.)

IP-based authentication is *not* well-suited for users behind NAT devices because multiple distinct users might share a single public IP address, leading to incorrect authentication or security issues.

With IP-based authentication, once an IP address is authenticated, all subsequent sessions originating from that same IP address are considered authenticated for the duration of the authentication timeout, effectively treating them as a single user.

IP-based authentication typically consumes less memory on the FortiGate compared to session-based authentication because it tracks authentication per IP address rather than individually for each distinct session.

Browser cookies are used by session-based authentication to maintain user authentication across multiple browser requests, not by IP-based authentication.