For a semester exam, which option is correct about attack surface reduction?

A. minimizing exposed entry points, services and interfaces attackers can abuse B. opening all ports C. removing all logging D. publishing private keys