What can be used to replace static ACLs on Internet-facing interfaces?

What can be used to replace static ACLs on Internet-facing interfaces?

A.
dynamic ACLs

B.
service provider firewalls

C.
VPNs
D. zone-based firewalls