You have created AWS EFS with default settings and mounted it on an EC2 instance. Due to regulatory policies, your organization had asked you to encrypt data stored on EFS. What would you do to enable encryption?

Answer options:

A.Edit EFS volume and enable the “encryption at rest” setting. All existing data automatically gets encrypted as a background process. You will be notified once the process is completed.
B.Encryption at rest is enabled by default when creating a new file system using the Amazon EFS console.
C.You can enable encryption at rest during the mounting of EFS on EC2. To encrypt an existing EFS mount, unmount the EFS and remount with the encryption option.
D.EFS does not support encryption. Use S3 for encrypting data at rest.

Answer: B
Amazon EFS supports two forms of encryption for file systems, encryption of data in transit and encryption at rest. You can enable encryption of data at rest when creating an Amazon EFS file system. You can enable encryption of data in transit when you mount the file system.
Note: Encryption at rest is not enabled by default when creating a new file system using the AWS CLI, API, and SDKs. 
Amazon EFS uses an industry-standard AES-256 encryption algorithm to encrypt EFS data and metadata at rest. 
Option A is incorrect. You cannot enable encryption once EFS is created.
Option C is incorrect. You cannot enable encryption at rest through mounting options.
Option D is incorrect. It is a distractor. EFS does support encryption.
Reference:
https://docs.aws.amazon.com/efs/latest/ug/encryption-at-rest.html