Turn on Amazon EBS encryption for the instances and enable Amazon RDS encryption using AWS KMS keys is correct because it applies native at rest encryption to both the EC2 attached disks and the managed database storage and it covers snapshots and automated backups when enabled at creation.

This choice leverages AWS Key Management Service to protect data on Amazon EBS and Amazon RDS so personally identifiable information is encrypted wherever it is stored. Enabling encryption at the storage layer ensures active volumes and database files are encrypted without requiring application level changes.

Enable Amazon RDS encryption at creation and use AWS Backup with backup vault lock for the EC2 volumes is incorrect because backup vault lock hardens backups and retention policies but it does not encrypt the active EBS volumes unless EBS encryption is also enabled.

Configure TLS for database connections and rely on an AWS KMS key from the application to protect data is incorrect because TLS protects data in transit only and an application managed KMS key does not automatically encrypt the underlying storage unless the application explicitly encrypts data before writing to disk.

Deploy AWS CloudHSM, generate keys, and use them only to encrypt the database storage is incorrect because CloudHSM is unnecessary for this requirement and using it only for the database leaves EC2 EBS volumes unencrypted and adds operational complexity.

Full AWS Practitioner Certification Question