Which portion of an HTTP request is examined by data access control rules?

Which portion of an HTTP request is examined by data access control rules?

A.
the TCP header

B.
the URL portion of the request

C.
the UDP header

D.
the URI portion of the request