Encrypting all data at rest and in transit in the cloud with customer managed encryption keys is the correct choice.

Encrypting data with customer managed keys ensures that stored and transmitted information is unreadable without the keys and it gives the customer direct control over key creation, rotation, revocation, and auditing so they can limit or revoke access even if cloud accounts or services are compromised.

Encryption in transit protects data from interception while it moves between clients and cloud services. Encryption at rest protects data stored in databases, object stores, and backups. Customer managed keys combine both protections with customer ownership of key lifecycle and usage logs which materially reduces the risk of unauthorized access to the data held by a public cloud vendor.

Using VPC Service Controls to establish a security perimeter around cloud services is not the best single action because perimeter controls limit where services can be called from but they do not make data unreadable and they may not stop access by a compromised privileged account or by provider personnel with access.

Migrating sensitive systems to an on premises private cloud environment managed internally is not the most effective single action because moving systems is costly and operationally complex and it does not inherently provide stronger cryptographic protections for the data that remains in the public cloud. The question asks about protecting data stored with a public cloud vendor so controls that protect that data in place are more relevant.

Restricting cloud access to a small set of trusted accounts reduces the attack surface but it does not protect the data if those accounts are compromised or if the cloud provider or its administrators have access. Encryption with customer managed keys provides protection even when account-based controls fail.

Full AWS Practitioner Certification Question