A company is building an AWS-hosted application that stores sensitive information. The support team has infrastructure access, including databases. The security engineer must protect the sensitive data against breaches while minimizing operational overhead, and credentials must rotate regularly. What should the security engineer recommend?

The correct option provides a comprehensive and secure solution with minimal operational overhead. Amazon RDS encryption protects data at rest and in snapshots. EBS encryption secures data on EC2 instances. Storing database credentials in AWS Secrets Manager with automatic rotation ensures regular credential updates without manual intervention, fulfilling the requirement for regular rotation and minimizing overhead. Requiring TLS for connections encrypts data in transit, preventing eavesdropping. The first incorrect option places database credentials in EC2 user data, which is insecure as it's easily accessible. The second incorrect option suggests installing the database on an EC2 instance and using third-party disk encryption, which is less managed than RDS and adds operational overhead. Storing credentials in AWS CloudHSM is overkill and more complex than Secrets Manager for this use case. The fourth incorrect option suggests storing KMS keys in CloudHSM, which is unnecessary as KMS already provides secure key storage. It also suggests using AWS Systems Manager Parameter Store for credentials, which, while capable of storing secrets, lacks the native automatic rotation capabilities of Secrets Manager for database credentials.