Provision a new encrypted EBS volume, attach it to the instance, migrate the data, and retire the old unencrypted volume and Copy an unencrypted snapshot of the volume, encrypt the copied snapshot, and create a new volume from it are correct because both approaches produce an encrypted replacement without attempting in place encryption of the existing volume.

You cannot enable encryption on an existing Amazon EBS volume in place. Creating a new encrypted volume and copying the data to it lets the instance remain running while data is migrated and the old unencrypted volume is retired. The snapshot copy approach lets you copy the current unencrypted snapshot, mark the copy as encrypted, and then restore an encrypted volume from that copy to replace the original.

Enable EBS encryption by default in the account and rely on it to encrypt the existing unencrypted volume is incorrect because default encryption only affects newly created volumes and snapshots and does not retroactively encrypt volumes that already exist.

Unmount the current EBS volume, take a snapshot, encrypt that snapshot directly, and re-mount the same volume is incorrect because you cannot directly change an existing snapshot or volume from unencrypted to encrypted. The supported workflow is to copy the snapshot and encrypt the copy before creating a new encrypted volume.

Install a self-signed TLS certificate on the instance and use secure sessions to write data to the EBS volume is incorrect because TLS protects data in transit and does not provide encryption at rest for the EBS volume.

Full AWS Practitioner Certification Question