What is true of Vault tokens? Choose TWO correct answers.

Upon successful authentication using any enabled method (e.g., AppRole, userpass, LDAP), Vault issues a token to the client, representing their authenticated identity.

Vault tokens are for authentication, while unseal keys are used to decrypt the master key to bring a sealed Vault server online; they are distinct concepts.

While tokens are generally required for most authenticated Vault API calls, some endpoints (like `sys/health` or `sys/seal` in certain contexts) can be accessed unauthenticated, making 'every Vault call' an overstatement.

Standard human-readable Vault token IDs begin with `h.`, not `s.`, which is typically associated with service tokens or specific internal Vault components.

Vault tokens are fundamental to Vault's security model, as they are presented with every API request to authenticate the client and authorize access based on associated policies.