Regarding tunnel-mode SSL VPN, which three statements are correct? (Choose three.)

SSL VPN tunnel mode can be configured to use split tunneling, allowing only specific traffic destined for the corporate network to pass through the VPN tunnel while other traffic uses the client's local internet connection.

To establish a network-layer tunnel for SSL VPN in tunnel mode, a dedicated VPN client application (like FortiClient) must typically be installed and used on the end-user's workstation.

While an initial portal login might use a browser, the actual operation of SSL VPN in tunnel mode requires a dedicated client application, not continuous use of an Internet browser, which is more characteristic of web-mode SSL VPN.

SSL VPN tunnel mode creates a virtual network interface on the client, enabling all network applications on the client to send traffic through the secure tunnel, not just specific or first-party applications.

Upon successful connection in SSL VPN tunnel mode, the FortiGate unit dynamically assigns an IP address to the client's virtual network adapter from a pre-configured IP address pool.