Which option, when enabled with the correct threshold, would mitigate this attack without dropping legitimate traffic to other hosts inside the network?

A Palo Alto Networks firewall is being targeted by an NTP Amplification attack and is being flooded with tens of thousands of bogus UDP connections per second to a single destination IP address and port.

Which option, when enabled with the correct threshold, would mitigate this attack without dropping legitimate traffic to other hosts inside the network?
A . Zone Protection Policy with UDP Flood Protection
B . Classified DoS Protection Policy using destination IP only with a Protect action
C . QoS Policy to throttle traffic below maximum limit
D . Security Policy rule to deny traffic to the IP address and port that is under attack

Answer: B

Reference: https://live.paloaltonetworks.com/docs/DOC-1746