Assuming all other NAT settings in Global Properties are selected, what else must be configured so that a host on the Internet can initiate an inbound connection to this host?

You have configured Automatic Static NAT on an internal host-node object. You clear the box Translate destination on client site from Global Properties / NAT. Assuming all other NAT settings in Global Properties are selected, what else must be configured so that a host on the Internet can initiate an inbound connection to this host?

A.
A static route, to ensure packets destined for the public NAT IP address will reach the Gateway’s internal interface.

B.
A proxy ARP entry, to ensure packets destined for the public IP address will reach the Security Gateway’s external interface.

C.
The NAT IP address must be added to the anti-spoofing group of the external gateway interface

D.
No extra configuration is needed