What facts are true regarding controllers and APs in a Split MAC architecture?

An IP tunnel is established between the AP and controller for AP management and control functions.

Using centralized data forwarding, APs never tag Ethernet frames with VLAN identifiers or 802.1p CoS.

With 802.1X/EAP security, the AP acts as the supplicant and the controller acts as the authenticator.

Management and data frame types must be processed locally by the AP, while control frame types must be sent to the controller.

In a distributed data forwarding model, the AP handles frame encryption and decryption.