What is the best practice configuration on a publish dispatcher instance?

During security tests it becomes apparent that AEM specific paths were accessible on the publish instance, which should not be accessible to the public.

What is the best practice configuration on a publish dispatcher instance?
A . /0001 { /type "deny" /glob "/system/*"}
B . /0001 { /type "deny" /glob "*"}
C . /0001 { /type "deny" /url "/system/*"}
D . /0001 { /type "deny" /url "/сrх/*"]

Answer: B

Explanation:

as well as /system/* as /crx/* are AEM specific paths, the question is what is the best practice configuration on a publish dspatcher instance, this should be /0001 {/type "deny" /glob "*"} because of the deny all first, allow what’s needed afterwards principle