Which two countermeasures can mitigate STP root bridge attacks?

Which two countermeasures can mitigate STP root bridge attacks? (Choose two.)
A. root guard
B. BPDU filtering
C. Layer 2 PDU rate limiter
D. BPDU guard