When Enabling HTTP API Access for Embedded Elasticsearch, What Action

When enabling HTTP API access for embedded Elasticsearch, what action is required to secure access?

A) The access to the Elastic Search HTTP API needs to be controlled through firewall rules.
B) The Elasticsearch HTTP API needs to be configured to require authentication.
C) The users of Alfresco Process Services who should access Elasticsearch should be constrained.
D) The information available through the Elasticsearch HTTP API should be constrained.