Which two options ensure all ESXi servers are protected from unsigned code?

Which two options ensure all ESXi servers are protected from unsigned code? (Choose two.)
A. VM Encryption
B. vTPM
C. UEFI Secure Boot
D. TPM
E. vSAN Encryption