For object-based VPN routing to succeed, what must be configured?

For object-based VPN routing to succeed, what must be configured?

A.
A single rule in the Rule Base must cover traffic in both directions, inbound and outbound on the central (HUB) Security Gateway.

B.
No rules need to be created, implied rules that cover inbound and outbound traffic on the central (HUB) Gateway are already in place from Policy > Properties > Accept VPN-1 Control Connections.

C.
At least two rules in the Rule Base must created, one to cover traffic inbound and the other to cover traffic outbound on the central (HUB) Security Gateway.

D.
VPN routing is not configured in the Rule Base or Community objects. Only the native-routing mechanism on each Gateway can direct the traffic via its VTI configured interfaces.