For a semester exam, which option is correct about secure file upload?

A. trusting file extension only B. storing uploads in web root with execute permission C. validating type, size, content and storage location of uploaded files D. allowing executable uploads anywhere