Which is the best configuration option to protect internal users from malicious, java code, without stripping java scripts?

Which is the best configuration option to protect internal users from malicious, java code, without
stripping java scripts?

A.
Use the URI resource to block Java code

B.
Use CVP in the URl resource to black Java code

C.
Use the URl resource to strip applet tags

D.
Use the URl resource to strip ActiveX tags

Explanation: