Which statement is true about configuring access control lists to control Telnet traffic destined to the router itself?

Which statement is true about configuring access control lists to control Telnet traffic destined to the router itself?

A.
The ACL is applied to the Telnet port with the ip access-group command.

B.
The ACL should be applied to all vty lines in the in direction to prevent an unwanted user from connecting to an unsecured port.

C.
The ACL applied to the vty lines has no in or out option like ACL being applied to an interface.

D.
The ACL must be applied to each vty line individually.