Difference between beeline Embedded Client and Remote Client with HiveServer2 TCP Transport Mode

[#1]

I am going through Hortonworks documentation beeline vs hive cli and got to know that we can connect Hive using beeline using two different mode.

1. Embadded mode like !connect jdbc:hive2://
2. Remote Client with HiveServer2 TCP Transport Mode - !connect jdbc:hive2://<host>:<port>/<db>

From the documentation it is clear that Remote transport mode supports authentication with LDAP and Kerberos. It also supports encryption with SSL.

1. Does it mean Embedded mode don't support LDAP and Kerberos authentications.
2. Which mode is better for security point of view and which mode should I use to connect hive using beeline through a shell script.
3. What are the difference between both mode. Couldn't understand much from the documentation and expecting the details explanations.

[#2]

I think both mode is quite the same, you should choose these mode base on your own cluster specification. I use embedded mode and it also supports Kerberos