It isn't illegal to access the address of a local variable, however, it is illegal to return the address of a local variable (because its Activation Record would soon be popped off)
I'm assuming that's what Option D means? If it does, then we can eliminate Option D.
Option A is the most appropriate, as foo() accepts an integer variable as an argument (and not an address) which would mean it is pass by value, and hence the actual input whose square we want to obtain would stay intact.
Option A