A company runs applications on Amazon RDS for MySQL. A security audit found an RDS DB instance that is not encrypted at rest, violating policy. The security engineer must encrypt all existing RDS databases with server-side encryption and detect any future noncompliant creations. Which combination of actions meets these requirements? (Choose two.)

To encrypt existing unencrypted RDS instances, you must take a snapshot, copy it with encryption enabled, and then restore a new DB instance from that encrypted snapshot. The original unencrypted instance can then be deleted. This is the standard procedure for encrypting an unencrypted RDS instance after creation. To detect future noncompliant creations, an AWS Config rule can be created to monitor for RDS DB instances that are not encrypted at rest. This rule can then trigger an Amazon EventBridge event on compliance state changes, which can, in turn, use Amazon SNS to notify the security operations team. Modifying an existing unencrypted RDS instance to enable encryption directly is not supported by AWS. Creating a read replica and promoting it would work for encryption, but it's a more complex process than the snapshot method and doesn't address future compliance. AWS Systems Manager State Manager is for managing configurations, not for detecting compliance violations like AWS Config.