Configure the Lambda function to use an AWS KMS customer managed key, generate a data key with KMS, and encrypt data before writing to /tmp is correct because it enforces application layer encryption for the function's ephemeral storage and ensures sensitive payment files are encrypted at rest before they are written to the local filesystem.

The secure pattern uses envelope encryption with AWS KMS data keys. With Configure the Lambda function to use an AWS KMS customer managed key, generate a data key with KMS, and encrypt data before writing to /tmp the function calls KMS GenerateDataKey to receive a plaintext data key and a ciphertext blob. The function uses the plaintext key to encrypt the intermediate files in /tmp and then discards the plaintext key. The ciphertext blob can be stored if you need to decrypt later by calling KMS.

Attach the Lambda function to a VPC and mount an encrypted Amazon EBS volume to /tmp is wrong because Lambda cannot mount Amazon EBS volumes into the execution environment. VPC attachment manages networking only and does not provide block device mounts for /tmp.

Enable default encryption on an Amazon S3 bucket with a KMS customer managed key and mount the bucket to /tmp is incorrect because you cannot mount an S3 bucket into the Lambda runtime as a local /tmp directory. S3 encryption protects objects stored in S3 but it does not apply to files written to the function's ephemeral storage.

Mount an encrypted Amazon EFS access point and rely on EFS encryption at rest for files written to /tmp is not applicable because EFS is a separate filesystem that must be mounted to a chosen path and it does not replace the Lambda instance's local /tmp directory. Relying on EFS encryption at rest does not by itself encrypt files placed in the ephemeral /tmp storage.

Full AWS Practitioner Certification Question