You need to control SSH, HTTP, and Telnet access to an MX240 router through any interface. You have decided to use a firewall filter. How should you apply the firewall filter?

An outbound filter on fxp0 (the management interface) would only filter traffic leaving the router via fxp0, not traffic destined to the router for management.

An outbound filter on lo0 would filter traffic originating from the router's control plane, not traffic attempting to reach the router's control plane.

An inbound filter on fxp0 would only control access coming through the fxp0 management interface, not through other data plane interfaces that might also be used for management access if not properly secured.

Applying an inbound firewall filter to the loopback interface (lo0) is the most effective way to control management access (like SSH, HTTP, Telnet) to the router itself. All traffic destined for the router's local processes will eventually be routed to lo0, ensuring that the filter is applied regardless of the ingress physical interface.