The BEST filter rule for protecting a network from being used as an amplifier in a denial of service (DoS) attack is to deny all:
A、outgoing traffic with IP source addresses external to the network.
B、incoming traffic with discernible spoofed IP source addresses.
C、incoming traffic with IP options set.
D、incoming traffic to critical hosts.