A company is using a Redshift cluster to store its data warehouse. There is a requirement from the Internal IT Security team to encrypt data in the Redshift database. How could this be achieved? (SELECT TWO)

Answer options:

A.Encrypt the EBS volumes of the underlying EC2 Instances.
B.Use AWS KMS Customer Default master key.
C.Use SSL/TLS for encrypting the data.
D.Use hardware security module (HSM) to manage the top-level encryption keys .

Correct Answer - B and D
AWS documentation mentions the following:
Amazon Redshift uses a hierarchy of encryption keys to encrypt the database. You can use either AWS Key Management Service (AWS KMS) or a hardware security module (HSM) to manage the top-level encryption keys in this hierarchy. The process that Amazon Redshift uses for encryption differs depending on how you manage keys.
Option D is correct. We can use the hardware security module (HSM) to manage the top-level encryption keys for key management with Amazon Redshift.
Reference:
https://aws.amazon.com/blogs/big-data/encrypt-your-amazon-redshift-loads-with-amazon-s3-and-aws-kms/
https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-db-encryption.html