A. It prevents incoming traffic from IP address ranges 10.0.0.0-10.0.0.255, 172.16.0.0- 172.31.255.255,
192.168.0.0-192.168.255.255 and logs any intrusion attempts.

B. It prevents the internal network from being used in spoofed denial of service attacks and logs any exit to the Internet.

C. It filters incoming traffic from private addresses in order to prevent spoofing and logs any intrusion attempts.

D. It prevents private internal addresses to be accessed directly from outside.