what protocol must be allowed through the NAT/Firewall?

If a Remote AP (RAP) is attempting to contact a controller that is behind a NAT device what
protocol must be allowed through the NAT/Firewall?

A.
PAPI

B.
NATT

C.
IPSec

D.
SSH

E.
GRE