Where is client traffic decrypted in a controller-based wireless network protected with WPA2 Security?

Where is client traffic decrypted in a controller-based wireless network protected with WPA2 Security?
A. Access Point
B. Switch
C. Wireless LAN Controller
D. Authentication Server