You have created AWS EFS with default settings and mounted it on an EC2 instance. Due to regulatory policies, your organization had asked you to encrypt data during transit to EFS. What would you do to enable encryption during transit?

Answer options:

A.AWS EFS uses NFS protocol which encrypts the data in transit by default.
B.Edit EFS to enable “encryption during transit” setting.
C.Encryption during transit can only be enabled during EFS creation. You need to create encryption during transit EFS, copy data from old EFS to new EFS and delete old EFS.
D.Encryption during transit can be enabled when mounting the file system using the Amazon EFS mount helper. The mount helper uses TLS version 1.2 to communicate with the file system.

Answer: D
You can encrypt data in transit using an Amazon EFS file system, without modifying your applications.
Enabling encryption of data in transit for your Amazon EFS file system is done by enabling Transport Layer Security (TLS) when you mount your file system using the Amazon EFS mount helper. 
When encryption of data in transit is declared as a mount option for your Amazon EFS file system, the mount helper initializes a client stunnel process. Stunnel is an open-source multipurpose network relay. The client stunnel process listens on a local port for inbound traffic, and the mount helper redirects Network File System (NFS) client traffic to this local port. 
Option A is incorrect because NFS protocol is not provided by default.
Options B and C are incorrect. Encryption during transit is not an option on EFS during or after creation.
Reference:
https://docs.aws.amazon.com/efs/latest/ug/encryption-in-transit.html