Which solution should a solutions architect recommend to meet this requirement with the LEAST amount of changes to the infrastructure?

A company is running a highly sensitive application on Amazon EC2 backed by an Amazon RDS database Compliance regulations mandate that all personally identifiable information (Pll) be encrypted at rest.

Which solution should a solutions architect recommend to meet this requirement with the LEAST amount of changes to the infrastructure?
A . Deploy AWS Certificate Manager to generate certificates Use the certificates to encrypt the database volume
B . Deploy AWS CloudHSM, generate encryption keys, and use the customer master key (CMK) to encrypt database volumes
C . Configure SSL encryption using AWS Key Management Service customer master keys (AWS KMS CMKs) to encrypt database volumes.
D . Configure Amazon Elastic Block Store (Amazon EBS) encryption and Amazon RDS encryption with AWS Key Management Service (AWS KMS) keys to encrypt instance and database volumes

View Answer

Answer: D