which kind of packet classification on IP packets that are encapsulated with GRE and IPsec?

The Cisco IOS and IOS XE qos pre-classify command allows which kind of packet classification on IP
packets that are encapsulated with GRE and IPsec?

A.
allows for packets to be classified based on the ToS byte values before packet encryption

B.
allows for packets to be classified based on the ToS byte values after packet encryption

C.
allows for packets to be classified based on the packet payload before packet encryption

D.
allows for packets to be classified based on the packet payload after packet encryption

E.
allows for packets to be classified based on the packet header parameters other than the ToS byte
values after packet encryption

Explanation:
http://www.cisco.com/en/US/tech/tk543/tk545/technologies_tech_note09186a008017405e.shtml
The qos pre-classify command
When packets are encapsulated by tunnel or encryption headers, QoS features are unable to
examine the original packet headers and correctly classify the packets. Packets traveling across the
same tunnel have the same tunnel headers, so the packets are treated identically if the physical
interface is congested. With the introduction of the Quality of Service for Virtual Private Networks
(VPNs) feature, packets can now be classified before tunneling and encryption occur.
In this example, tunnel0 is the tunnel name. The qos pre-classify command enables the QoS for VPNs
feature on tunnel0:
Router(config)# interface tunnel0
Router(config-if)# qos pre-classify