<strong>The DevOps team of your company is considering to use AWS CodeCommit rather than Github. The company has very strict security policies and needs to confirm whether or not CodeCommit is secure. They need to make sure that all new tools are able to pass their annual security audits (which come from an external organization). One key part of the audit is to check if the important data is encrypted. What should the DevOps team do to make sure that the CodeCommit pass the security audit?</strong>

Answer options:

A.AWS CodeCommit repositories are already encrypted at rest however the team should configure the CodeCommit to encrypt the data in transit such as during “git push”.
B.The team should create a key in KMS for "CodeCommit" and ensure that "CodeCommit" uses that newly created key to encrypt all data in transit and at rest.
C.Nothing, as data in AWS CodeCommit repositories is already encrypted in transit as well as at rest.
D.During the creation of a new CodeCommit repo, ensure that the setting of Encryption is enabled. Therefore, data in transit and at rest are encrypted, and the CodeCommit is able to pass the audit.

Option C is Correct.
For AWS CodeCommit repositories, the data is encrypted in transit and at rest as well. When data is pushed into an AWS CodeCommit repository (for example, by calling git push), AWS CodeCommit encrypts the received data as it is stored in the repository. When data is pulled from an AWS CodeCommit repository (for example, by calling git pull), AWS CodeCommit decrypts the data and then sends it to the caller.
Also, CodeCommit creates an AWS-managed key in that same region in AWS Key Management Service (AWS KMS) that is used only by AWS CodeCommit (the aws/ codecommit key). This key is created and stored in your AWS account. The user does not need to create a new key manually for CodeCommit.
Option A is incorrect because the data at transit is also encrypted by CodeCommit as well.
Option B is incorrect because CodeCommit creates a new key by itself. No manual work is needed.
Option D is incorrect because there are no such settings for encryption. All data is encrypted automatically.