Which of the Following Minimizes the Potential Attack Surface for Applications

Which of the following minimizes the potential attack surface for applications?

A) Use security groups to provide stateful firewalls for Amazon EC2 instances at the hypervisor level.
B) Use network ACLs to provide stateful firewalls at the VPC level to prevent access to any specific AWS resource.
C) Use AWS Direct Connect for secure trusted connections between EC2 instances within private subnets.
D) Design network security in a single layer within the perimeter network (also known as DMZ, demilitarized zone, and screened subnet) to facilitate quicker responses to threats.