In which location is the 802.11 encryption terminated and the traffic decrypted for Clients A1, A2, A3?

Refer to the exhibit.

A customer configures three different SSIDs with three different forwarding modes on a Remote AP (RAPB). Client A1 connects to the Family SSID, which is in bridge-mode. Client A2 connects to the Enterprise 801.1X SSID, which is in split-tunnel mode. Client A3 connects to the Voice PSK SSID, which is in tunnel mode.

In which location is the 802.11 encryption terminated and the traffic decrypted for Clients A1, A2, A3?
A . Client A1 traffic is at C; Client A2 is at B; Client A3 is at
C . Client A1 traffic is at B; Client A2 is at B; Client A3 is at
E . Client A1 traffic is at B; Client A2 is at D; Client A3 is at
G . Client A1 traffic is at B; Client A2 is at D; Client A3 is at

Answer: C