Which three statements about security associations (SA) in IPsec are correct? (Choose three.)

Phase 2 SAs, also known as IPsec SAs, are specifically established after Phase 1 to apply encryption and authentication algorithms to the actual user data flowing through the VPN tunnel.

Security Associations (SAs) always have an expiration or lifetime, whether time-based, volume-based, or both, to ensure cryptographic keys are periodically refreshed and security is maintained.

A Phase 1 SA (IKE SA) is a single, logical, bidirectional connection established between two peers to secure the exchange of keys and parameters for Phase 2 SAs, whereas Phase 2 SAs (IPsec SAs) are directional, requiring two separate SAs (one for inbound, one for outbound traffic) for a single secure data flow.

To enhance security and facilitate rekeying, Phase 2 SAs are configured with lifetimes that dictate when they expire, which can be based on a set duration of time, a specific volume of data transferred, or whichever condition is met first.

While a Phase 1 SA is bidirectional, Phase 2 SAs are strictly directional, meaning two distinct SAs are created for bidirectional data flow within the IPsec tunnel to handle separate inbound and outbound traffic.