What is required to support policy-based NAT when using route-based VPNs?

What is required to support policy-based NAT when using route-based VPNs?

A.
Tunnel interface must have a custom zone assigned

B.
Tunnel interface must have an IP address

C.
Policy defined for VPN traffic

D.
Tunnel interface must be unnumbered