Which statement is true about configuring access control lists to control Telnet traffic destined to the router itself?

Which statement is true about configuring access control lists to control Telnet traffic destined to
the router itself?

A.
The ACL is applied to the Telnet port with the ip access-group command.

B.
The ACL should be applied to all vty lines in the in direction to prevent an unwanted user from
connecting to an unsecured port.

C.
The ACL applied to the vty lines has no in or out option like ACL being applied to an interface.

D.
The ACL must be applied to each vty line individually.

Explanation:
http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_acl/configuration/12-4t/sec-cntrl-accvtl.html
Controlling Access to a Virtual Terminal Line

You can control who can access the virtual terminal lines (vtys) to a router by applying an access list
to inbound vtys. You can also control the destinations that the vtys from a router can reach by
applying an access list to outbound vtys.
Benefits of Controlling Access to a Virtual Terminal Line
By applying an access list to an inbound vty, you can control who can access the lines to a router. By
applying an access list to an outbound vty, you can control the destinations that the lines from a
router can reach.