For a semester exam, which option is correct about secure software design?

A. adding security only after release B. designing only the logo C. creating architecture and components that reduce attack surface and enforce security principles D. skipping architecture review