What is the best practice configuration on a publish dispatcher instance?

During security tests it becomes apparent that AEM specific paths were accessible on the publish instance, which should not be accessible to the public.

What is the best practice configuration on a publish dispatcher instance?
A . /0001 { /type "deny" /glob "/system/*"}
B . /0001 { /type "deny" /glob "*"}
C . /0001 { /type "deny" /url "/system/*"}
D . /0001 { /type "deny" /url "/сrх/*"]

Answer: D