Which profile or policy should be applied to protect against port scans from the internet?

Which profile or policy should be applied to protect against port scans from the internet?
A . Interface management profile on the zone of the ingress interface
B . Zone protection profile on the zone of the ingress interface
C . An App-ID security policy rule to block traffic sourcing from the untrust zone
D . Security profiles to security policy rules for traffic sourcing from the untrust zone

Answer: B