How are Logical Firewall rules applied to affected virtual machines?

A.
They are pushed by the NSX Controllers into all the ESXi hosts in the same Transport Zone.

B.
They are pushed by the NSX Manager to the ESXi hosts running the source and/or destination
virtual machines.

C.
They are pushed by the NSX Controllers to the ESXi hosts running the destination virtual
machines.

D.
They are pushed by the NSX Manager to all the ESXi hosts in the NSX environment.