What can be used to replace static ACLs on Internet-facing interfaces?

What can be used to replace static ACLs on Internet-facing interfaces?
A. dynamic ACLs
B. service provider firewalls
C. VPNs
D. zone-based firewalls