For a semester exam, which option is correct about threat modeling?

A. identifying likely threats and designing mitigations before or during development B. writing code with no assumptions C. formatting the final report D. only buying hardware