Which of the following statements is a good guideline in preparing for zero$-$day vulnerabilities?

A Common industry$-$recommended security controls can mitigate the risk associated with zero$-$day attacks.

B Since zero$-$day attacks are unexpected, they threaten all assets equally.

A zero$-$day vulnerability might already have been patched by the vendor.

D Zero$-$day vulnerabilities can be exploited by only external threat$-$actors.