The correct answer is D. Automatic NAT can be configured inside supported network objects such as Host objects, where the administrator defines translation behavior directly on the object's NAT properties. In this question's answer set, Host Object is the correct option. A Service Object defines protocol and port information; it does not own automatic address translation settings. A Network Group object is a grouping construct and is not the best location for automatic NAT settings in this exam item. A Domain Object represents DNS/domain matching behavior and is not where standard automatic NAT rules are enabled. Automatic NAT is different from Manual NAT: automatic NAT is generated from object settings, while manual NAT rules are explicitly created in the NAT rulebase. The important CCSA concept is that NAT can change source or destination IP addresses and ports, but the administrator must configure it either through object-level automatic NAT or explicit NAT rules.
Reference topics: NAT Policy, Automatic NAT, Host object NAT properties, Security Policy Management.