Answer: Migrate the databases to Amazon RDS Configure encryption at rest.

## Explanation **Correct Answer: B** **Why Option B is correct:** 1. **Amazon RDS** provides a managed database service that reduces operational overhead compared to self-managed databases on EC2. 2. **Encryption at rest** using AWS KMS keys provides strong security for sensitive data stored in the database. 3. RDS handles encryption transparently, including automatic encryption of backups, snapshots, and read replicas. 4. This solution addresses both requirements: increased security (through encryption) and reduced operational overhead (through managed service). **Why other options are incorrect:** **Option A:** - Migrating to EC2 requires managing the database infrastructure yourself, which increases operational overhead rather than reducing it. - While using AWS KMS for encryption provides security, the operational burden remains high. **Option C:** - Amazon S3 is not suitable for transactional database workloads; it's an object storage service. - Amazon Macie is for discovering and protecting sensitive data in S3, not for transactional databases. - This doesn't address the database migration requirement. **Option D:** - While Amazon RDS reduces operational overhead, CloudWatch Logs is for monitoring and logging, not for data encryption or primary security protection. - CloudWatch Logs doesn't provide encryption at rest for the database itself. **Key AWS Services:** - **Amazon RDS**: Managed relational database service that reduces operational overhead - **Encryption at rest**: Uses AWS KMS to encrypt data stored in RDS instances, backups, and snapshots - **AWS KMS**: Managed encryption key service that integrates with RDS for encryption

Author: LeetQuiz Editorial Team