I just checked javadoc and option 2 and 3 should be valid (by now only option 3 is valid)
moreover given the exlanation for option 3
httpServlet also implements this interface ... so the service method cannot be protectedBecause it is declared in an interface [javax.servlet.Servlet] and all interface methods are public. You cannot reduce the accessibility of an overriding or implementing method.