Which statement is correct about tunnel interfaces?

Which statement is correct about tunnel interfaces?

A.
They need to be configured in the zone where the protected resources reside.

B.
They can be unnumbered from any interface residing on the same virtual router as the protected resources.

C.
They can have overlapping IP addresses.

D.
They can be unnumbered and used in policy-based translations if the interface is in route mode.