How does the Cisco Security MARS appliance perform IP address correlation (that is, map IP address translation) across NAT and PAT boundaries?

A.
uses the NetFlow data

B.
queries the PAT and NAT translation table through topological awareness and device configuration

C.
analyzes the syslog messages that are received from the firewall devices in the network

D.
uses a NAT detection protocol to correlate the pre- and post-NAT and PAT addresses

E.
uses predefined Cisco Security MARS system NAT rules to correlate events across NAT and PAT boundaries

F.
uses NAT-T detection