For a semester exam, which option is correct about software supply chain security?

A. protecting third-party components, build systems and dependencies B. downloading binaries from untrusted sites C. using unknown packages without review D. ignoring dependency updates