1.It can authenticate non windows users
2. It uses STS (Secure Token Service)
3.When CBA is enabled, AD users cannot be authenticated
4.It is based on identity and trust.
Answer:3