The correct answer is Encrypt all persistent storage on the compute instances.

Encrypt all persistent storage on the compute instances is the top priority because encryption protects data at rest even if an instance is compromised or disks and snapshots are copied or stolen. Strong encryption ensures that attackers cannot read stored data without the keys and it provides protection independent of perimeter controls and user credentials. Proper key management and the use of cloud provider managed or customer managed keys make this control effective and practical at scale.

Tighten user authentication requirements for instance access is important but it focuses on preventing unauthorized access rather than protecting the stored data if access controls fail or if storage media are exfiltrated. Authentication does not render stolen volumes unreadable.

Apply network zoning to isolate the compute instances reduces attack surface and limits lateral movement, but it does not protect data on disks or snapshots that may be accessed or copied by an attacker who gains privileges or by a misconfigured backup process.

Deploy endpoint antivirus and malware protection on instances can detect and reduce some threats, but it does not guarantee protection of data at rest and it may not stop sophisticated attacks or avoid exposure from stolen or misconfigured storage. Antivirus should be one layer in a defense in depth strategy rather than the single highest priority for preventing data exposure.

Full AWS Practitioner Certification Question