The correct answer is C. This option specifies using AWS Key Management Service (AWS KMS) to encrypt the EBS volumes and Aurora database storage at rest, and attaching an AWS Certificate Manager (ACM) certificate to the Application Load Balancer (ALB) to encrypt data in transit. This approach ensures compliance with the requirement that all data be encrypted both at rest and in transit. Options A, B, and D either use incorrect services or incorrect implementation methods for fulfilling these requirements.