Which of the following can be done to secure BIND server?

Which of the following can be done to secure BIND server?
(Select 3 correct answers)

A.
Run the BIND daemon as nonroot user

B.
Configure ACLs

C.
Require clients to authenticate a password before querying the server

D.
Run the BIND daemon in a chroot jail

E.
Encrypt DNS traffic using SSL/TLS