1) No such thing. Every system based on passwords is vulnerable to brute force attack. But consider DRM, if your budget is in the tens of thousands of dollars p.a.
The only option to protect an eBook (be it in PDF, ePub or anything else) from unauthorized copying is to use digital rights management - DRM. Many eBook retailers apply some form of DRM to their catalogs (e.g. Amazon uses a home-brew DRM system for content sold to the Kindle platform) so if you're signed with one of them, it's out of your hands. If you're distributing your own files, DRM becomes very expensive to implement.
Password protection on PDF files does nothing to prevent someone from sharing the file with world+dog, and you have no way to track the copies or deactivate them. Permissions restrictions (e.g. to prevent extraction of text or printing) are not respected by third-party software and are trivial to remove, so a watermark is pretty meaningless and there is no such thing as an 'airtight' password.
DRM solutions such as LiveCycle ES4 Rights Management can track and revoke individual copies, guarantee permissions are complied with, and the protection workflow can be integrated with automated sales software, but consumers must use Adobe Reader to view their books - which limits the options on some platforms. Unlike some of the third-party DRM engines, LiveCycle has never been cracked (which is why it's popular with governments and the military). Whether the cost is realistic for a single title is another matter entirely; as you'd be looking at five-figure dollar prices for an ES4 license.
You can add watermark in Acrobat and specify whether it is visible only on screen or only in printed copy or both. 3rd party (non-Adobe) PDF Readers may not respect these settings and may either show watermark in either case or not show it at all. You can Google "PDF watermarks in Acrobat" for more info.