Which option should be included in the data center design if it must support zone-based firewalling on a per virtual machine basis, while preserving full virtual machine mobility without manual intervention?

Which option should be included in the data center design if it must support zone-based firewalling on a per virtual machine basis, while preserving full virtual machine mobility without manual intervention?
A. Cisco Virtual Services Gateway with vPath
B. Cisco Nexus 1000v Advanced Edition with Prime Network Services Controller
C. Cisco Nexus 5500 Series Layer 3 module
D. strict unicast RPF