Based on the capabilities of the Palo Alto Networks NGFW, what are two ways to configure a security policy using App-ID to comply with this request?

untrust to the internet

Based on the capabilities of the Palo Alto Networks NGFW, what are two ways to configure a security policy using App-ID to comply with this request? (Choose two)
A . Create a deny rule at the top of the policy from trust to untrust over any service and select evasive as the application
B. Create a deny rule at the top of the policy from trust to untrust with service application-default and select evasive as the application.
C. Create a deny rule at the top of the policy from trust to untrust over any service and add an application filter with the evasive characteristic.
D. Create a deny rule at the top of the policy from trust to untrust with service application-default and add an application filter with the evasive characteristic

Answer: D