How do you prevent a hacker from launching FIN, NULL, and X-MAS scans on your network?

Port scans are often used to profile systems before they are attacked. Knowing what ports are open allows an attacker to determine which services can be attacked.
How do you prevent a hacker from launching FIN, NULL, and X-MAS scans on your network?

A.
Block TCP/IP packets with FIN flag enabled at the firewall

B.
Enable IDS signatures to block these scans

C.
You cannot block a hacker from launching these scans on your network

D.
Modify the kernel to never send reset (RST) packets