Which two configuration options are available on a Cisco WSA within a decryption policy?

Which two configuration options are available on a Cisco WSA within a decryption policy? (Choose two.)
A. Pass Through
B. Warn
C. Decrypt
D. Allow
E. Block