The correct answer is Create an encryption scope for the storage account.

A Create an encryption scope for the storage account lets you define a specific encryption key that containers can use for server side encryption. You create the encryption scope before you create the container so the container can reference that scope at creation time. Encryption scopes support using a customer managed key when you need one container to use a different key than the rest of the account.

Rotate the storage account access keys is not correct because rotating access keys affects authentication secrets and access, and it does not provision or assign a different encryption key for a specific container.

Assign a customer managed key to the entire storage account is not correct because assigning a single customer managed key at the account level applies that key to all containers and blobs. That approach does not allow one container to have a different key from the others.

Generate a shared access signature for the container is not correct because a shared access signature controls delegated access to storage resources and it does not set or change the encryption key used for data at rest.

Full AWS Practitioner Certification Question