The BEST filter rule for protecting a network from being used as an amplifier in a denial of service (DoS) attack is to deny all: 
A、outgoing traffic with IP source addresses external to the network. 
B、incoming traffic with discernible spoofed IP source addresses. 
C、incoming traffic with IP options set. 
D、incoming traffic to critical hosts.