The correct answer is C because the requirement separates encryption into two parts: encryption at rest and encryption in transit . For data at rest , AWS uses AWS Key Management Service (AWS KMS) to manage encryption keys for services such as Amazon EBS and Amazon Aurora . EBS volumes can be created as encrypted volumes by using KMS keys, and Aurora supports encryption at rest through KMS as well. This protects stored application and database data without requiring the company to build its own key management system.

For data in transit , the proper AWS service is AWS Certificate Manager (ACM) . An Application Load Balancer can use an ACM-issued or ACM-imported SSL/TLS certificate to terminate HTTPS connections and encrypt traffic between clients and the load balancer. This is the AWS standard approach for securing web traffic to internet-facing applications.

Option A is incorrect because it reverses the roles of the services. KMS does not provide certificates for TLS termination on an ALB , and ACM does not encrypt EBS or Aurora storage at rest . Option B is incorrect because there is no single account-wide console setting that automatically turns on all encryption for all services in this way, and use of the root account is not an AWS best practice for normal configuration tasks. Option D is incorrect because BitLocker is not the appropriate general AWS-native answer for EBS and Aurora encryption, and ALBs do not use KMS keys directly as TLS certificates.

AWS security best practices recommend KMS for encryption at rest and ACM certificates for encryption in transit . Therefore, option C is the correct solution.