The correct choice is Attach an encrypted Amazon EBS volume and configure Amazon Data Lifecycle Manager to run automated snapshots. This option provides an EC2-attached durable block device with encryption at rest and hands-free, scheduled volume-level snapshots that can be retained for the required 35 day window.

Amazon EBS is the block storage service designed to attach to EC2 instances and it supports encryption at rest with AWS managed or customer managed keys. Amazon Data Lifecycle Manager lets you create snapshot lifecycle policies that run on a schedule and enforce retention rules so backups are automated and retained for the specified period without manual intervention.

Create an encrypted Amazon EFS file system and use Amazon EventBridge to trigger AWS Lambda to copy data for backups is incorrect because Amazon EFS is network file storage accessed over NFS rather than an EC2-attached block device and orchestrating Lambda copy jobs produces file level copies rather than consistent volume snapshots.

Enable server-side encryption on an Amazon S3 bucket and configure Cross-Region Replication for redundancy is incorrect because Amazon S3 is object storage and cross region replication provides object redundancy rather than volume level backups of an EC2 root or data volume.

Use encrypted instance store volumes and schedule a cron job to copy data to another EC2 instance is incorrect because instance store is ephemeral and data can be lost when an instance stops or fails and a cron based copy is an ad hoc file level process that does not provide automated, consistent volume snapshots.

Full AWS Practitioner Certification Question