Which of the following statements regarding PHP session management is true?

A. A session ID is generated and stored on the server-side by default.

B. A session ID is always unique and cannot be duplicated.

C. Session data is always encrypted using a secret key.

D. PHP session management uses a cryptographically secure random number generator.

Hint: The answer requires a deep understanding of PHP session management and security best practices