The correct answers are C and D. Option C, 'Set EBS encryption as the default in the AWS Region, using the customer-managed key,' reduces operational overhead by ensuring all new EBS volumes are automatically encrypted with the customer-managed key. Option D, 'Create an EKS cluster with an IAM role allowing access to the customer-managed key,' ensures that the EKS cluster can use the customer-managed key without additional steps. These options together meet the requirement with minimal operational overhead.