The correct option is Create a DB snapshot, copy it with encryption enabled, restore a new DB from the encrypted copy, and retire the old instance. This option yields a new encrypted RDS instance without changing the database engine or application code.

This approach works because Amazon RDS does not allow enabling storage encryption on an existing DB instance after it is created. You take a snapshot of the unencrypted database and then copy that snapshot while enabling encryption with an AWS KMS key. You restore a new DB instance from the encrypted copy and then cut over traffic to the new instance and retire the old one. The restored instance and its automated backups and future snapshots are encrypted.

Create an RDS Blue/Green deployment, enable encryption on the green environment, switch over, and delete the original is incorrect because Blue/Green deployments do not change the underlying storage encryption of an existing environment. Encryption must be set at creation or when restoring from an encrypted snapshot.

Modify the existing RDS instance in the console to turn on encryption at rest is incorrect because the RDS service does not support flipping storage encryption on for a running instance. You must rebuild or restore into an encrypted instance.

Create a read replica, encrypt the replica, promote it to standalone, and decommission the original is incorrect because replicas inherit the encryption state of their source. An unencrypted primary will not produce an encrypted replica so this method will not create an encrypted standalone database.

Full AWS Practitioner Certification Question