How can these requirement be met?

Universal Containers conduct evaluations of their sales reps using a custom object consisting of numerical scores and executive comments. The company wants to ensure that only the sales reps, and their manager’s executive can view the rep’s evaluation record but the reps should not be able to view the executive comment field on their review.

How can these requirement be met?
A . Use a private sharing model granting record access using hierarchy; manage field access with record types and field-level security
B. Use a private sharing model granting record access using custom setting; manage field access with page layouts and field level security
C. Use a private sharing model granting record access using hierarchy; manage field access with field-level security
D. Use a private sharing model granting record access using custom setting; manage field access with record types and page layouts

Answer: C