To protect against port scans from the internet, applying a Zone Protection profile on the zone of the ingress interface is the appropriate action. Zone Protection profiles are specifically designed to protect network zones from various types of attacks, including port scans, by setting thresholds and enabling various protective mechanisms to mitigate such threats. Assigning an Interface Management profile or applying App-ID Security policy rules may not directly address the issue of port scans, and while Security profiles are useful for inspecting and controlling traffic, they are more focused on threats within the traffic rather than the initial detection and prevention of scanning activity at the ingress point.