The correct answer is New-OMEConfiguration.

New-OMEConfiguration is the Exchange Online PowerShell cmdlet that you run to create a new Office Message Encryption configuration and you can specify message expiration as part of that configuration when creating the policy. Use this cmdlet when you need to establish an OME policy that defines how long encrypted messages remain accessible to external recipients.

Set-OMEConfiguration is incorrect because that cmdlet is used to modify an existing OME configuration rather than to create a new one.

Cloud KMS is incorrect because it refers to a cloud key management service and not to an Exchange Online PowerShell cmdlet for configuring OME message expiry.

Set-TransportRule is incorrect because transport rules manage message flow actions and conditions and they do not create the OME configuration that sets message expiration.

Full AWS Practitioner Certification Question