Your company has mandated that all data in AWS be encrypted at rest. Which of the following options can achieve the requirement for EBS volumes in the easiest way?

Answer options:

A.Use Windows bit locker for EBS volumes on Windows instances.
B.Use TrueCrypt for EBS volumes on Linux instances.
C.Use AWS Systems Manager to encrypt the existing EBS volumes.
D.Enable EBS encryption during launch.

Answer – D
EBS encryption can be enabled when the volume is created and not for existing volumes.
Options A and B are incorrect because the most straightforward method is to encrypt the EBS volume in AWS when an EC2 instance is launched. There is no need to use other third-party tools.
Option C is incorrect. AWS Systems Manager is a management service that helps you automatically collect software inventory, apply OS patches, create system images, and configure Windows and Linux operating systems. It does not help in this scenario.
Option D is CORRECT. You can choose to encrypt a non-encrypted boot volume on an instance launch. 
https://aws.amazon.com/blogs/aws/new-encrypted-ebs-boot-volumes/