Which IDS guidelines should be followed, according to SAFE SMR?

Which IDS guidelines should be followed, according to SAFE SMR?

A.
use shunning on only UDP traffic, as it is more difficult to spoof than TCP

B.
use shunning no longer than 15 minutes

C.
use shunning on only TCP traffic, as it is more difficult to spoof than UDP

D.
use TCP shunning as opposed to TCP resets