What are two valid ways to enable Packet-Based Attack Protection?

A network security administrator wants to enable Packet-Based Attack Protection in a Zone Protection profile.

What are two valid ways to enable Packet-Based Attack Protection? (Choose two.)
A . ICMP Drop
B. TCP Drop
C. TCP Port Scan Block
D. SYN Random Early Drop

Answer: A,D