A company is building a new web-based customer relationship management application. The application will use several Amazon EC2 instances that are backed by Amazon Elastic Block Store (Amazon EBS) volumes behind an Application Load Balancer (ALB). The application will also use an Amazon Aurora database. All data for the application must be encrypted at rest and in transit. Which solution will meet these requirements?

The correct solution uses AWS Key Management Service (AWS KMS) for encrypting data at rest and AWS Certificate Manager (ACM) for encrypting data in transit. KMS is the standard AWS service for managing encryption keys and integrating with services like EBS and Aurora for at-rest encryption. ACM provides SSL/TLS certificates that can be easily attached to an Application Load Balancer (ALB) to handle encryption of data in transit between clients and the ALB. Incorrect options: KMS certificates don't exist; KMS manages encryption keys, not certificates for TLS. ACM is used for certificates. The AWS root account should not be used for daily operations or configuring encryption; it has excessive permissions and lacks auditing capabilities. There's no single option to encrypt all data at rest and in transit across an account. BitLocker is a Windows-specific encryption tool and is not applicable for encrypting AWS services like EBS volumes or Aurora databases. Importing TLS certificate keys to KMS and attaching KMS keys to an ALB for in-transit encryption is not how ALBs handle TLS; ACM certificates are used.