How are Logical Firewall rules applied to affected virtual machines?

How are Logical Firewall rules applied to affected virtual machines?

A.
They are pushed by the NSX Controllers into all the ESXi hosts in the same Transport
Zone.

B.
They are pushed by the NSX Manager to all the ESXi hosts in the NSX environment.

C.
They are pushed by the NSX Controllers to the ESXi hosts running the destination virtual
machines.

D.
They are pushed by the NSX Manager to the ESXi hosts running the source and/or
destination virtual machines.