What is the most recommended and secure OAuth scope setting that an Architect should recommend?

Universal Containers (UC) is planning to deploy a custom mobile app that will allow users to get e-signatures from its customers on their mobile devices. The mobile app connects to Salesforce to upload the e-signature as a file attachment and uses OAuth protocol for both authentication and authorization.

What is the most recommended and secure OAuth scope setting that an Architect should recommend?
A . Id
B. Web
C. Api
D. Custom_permissions

Answer: D