Where is client traffic decrypted in a controller-based wireless network protected with WPA2 Securit

Where is client traffic decrypted in a controller-based wireless network protected with WPA2
Security?

A.
Access Point

B.
Switch

C.
Wireless LAN Controller

D.
Authentication Server