How to prevent WPAD attack

Question

We had a pentration test in our company. One of the recommendations was to disable WPAD (Windows Proxy Auto Discovery), LLMNR, NetBIOS.

We have successfully disabled LLMNR by GPO, NetBIOS on DHCP as well as on the station using PS script. However little problem is with WPAD.

Our administrators disabled by GPO these items:

Windows Settings
|- Internet Explorer Maintenance
  |- Connection/Automatic Browser Configuration
     |- Automatically detect configuration settings - Disabled
|- Administrative Templates
  |- Windows Components / Internet Explorer
     |- Disable caching of Auto-Proxy scripts - Enabled
     |- Disable changing Automatic Configuration settings - Enabled  

I have found some instructions on how to check if WPAD is turned off. One of them was to check if this service is running:

sc query winhttpautoproxysvc

Another one was to check settings in the Windows control panel However even though mentioned settings in GPO, the service is still running, and the automatic proxy is still enabled.

I have also found information, it is enough to turn off LLMNR and NetBIOS, because it is a prerequisite for WPAD attack, but I am not sure about this.

Next, I have found information, the only possibility how to prevent WPAD attack, is to set DNS for wpad query to 127.0.0.1.

So my questions are:

1. Are the settings in GPO above enough to prevent WPAD attacks?
2. If No, what is the best way (setting) to prevent this attack?
3. To prevent WPAD attack, it is enough to turn off LLMNR and NetBIOS?