Allow SSH access from subnet 10.139.58.0/28 to the router (domain, crypto keys, and SSH configured). Which destination-router configuration permits the traffic?

The correct option uses an extended access list (120) to permit TCP traffic from the specified source subnet (10.139.58.0/28, wildcard mask 0.0.0.15) to any destination, specifically for SSH (port 22). Applying this access list with access-class 120 in to the VTY lines (0-15) correctly filters incoming SSH connections. SSH is a VTY-line service, so the access list must be applied there, not to an interface. The first incorrect option uses a standard access list (10) with UDP and an incorrect wildcard mask, which is wrong for SSH (TCP) and the subnet size. The second incorrect option uses a standard access list (110) with an interface application, which is incorrect for VTY access, and standard ACLs cannot filter by port number. The third incorrect option uses access-group instead of access-class for VTY lines.