What is a correct statement regarding administrative authentication using external services with a local authorization method?

What is a correct statement regarding administrative authentication using external services with a local authorization method?
A . Prior to PAN-OS 10.2. an administrator used the firewall to manage role assignments, but access domains have not been supported by this method.
B. Starting with PAN-OS 10.2. an administrator needs to configure Cloud Identity Engine to use external authentication services for administrative authentication.
C. The administrative accounts you define locally on the firewall serve as references to the accounts defined on an external authentication server.
D. The administrative accounts you define on an external authentication server serve as references to the accounts defined locally on the firewall.

Answer: B