where should the root guard feature be deployed?

When STP mitigation features are configured, where should the root guard feature be deployed?

A.
toward ports that connect to switches that shouldnot be the root bridge

B.
on all switch ports

C.
toward user-facing ports

D.
Root guard should be configured globally on the switch.