An application stores regulated data on EBS volumes attached to EC2 instances. Compliance requires encryption at rest with auditable, managed keys. Which approach meets this with the least operational overhead?
A) Manually encrypt files in the application before writing them to disk.
B) Enable EBS encryption using AWS KMS keys.
C) Store the data on instance store volumes instead.
D) Use an EC2 instance type with a larger CPU to handle encryption.
Correct Answer: B
Explanation: EBS integrates natively with AWS KMS to encrypt volumes, snapshots, and data in transit between the volume and instance — transparent to the application, with key usage logged in CloudTrail. (A) adds heavy app complexity. (C) instance store is ephemeral. (D) is irrelevant to encryption.