How Can You Restrict Access to a Custom API Resource

Multiple Choice

How can you restrict access to a custom API resource?

A) Only by creating a new role under System/Web Services/Roles
B) By setting up an ACL in etc/api.xml and creating a new role for it in System/Web Services/Roles
C) Only by extending Mage_Api_Controller_Action and overriding the _isAllowed method
D) By setting up an ACL in etc/adminhtml.xml and creating a new role in System/Permissions/Roles