An application uses an ElastiCache for Redis cluster for caching. The cluster already has encryption at rest enabled, but not encryption in transit, and clients can access the cache without authentication. A solutions architect must require client authentication and enable end-to-end in-transit encryption. Which solution meets these requirements?

The correct solution involves generating an AUTH token and storing it securely in AWS Secrets Manager. ElastiCache for Redis supports enabling client authentication (AUTH) and in-transit encryption on existing clusters, eliminating the need to create a new cluster. Secrets Manager is the recommended service for storing sensitive credentials like AUTH tokens. The application then retrieves this token from Secrets Manager to authenticate with the ElastiCache cluster. The first incorrect option suggests creating a new ElastiCache cluster, which is unnecessary as existing clusters can be modified. The third and fourth options incorrectly suggest using SSL certificates for client authentication. While SSL certificates are used for encryption in transit, ElastiCache for Redis uses AUTH tokens for client authentication, not SSL certificates. Additionally, the fourth option suggests updating the existing cluster with an SSL certificate for authentication, which is not how Redis authentication works.