To enable encryption at rest using EC2 and EBS, what action must be taken?

The correct action to enable encryption at rest using EC2 and EBS is to configure encryption during the creation of the EBS volume. When you create an EBS volume, AWS provides an option to enable encryption natively. This built-in feature allows you to secure your data at rest seamlessly without the need for additional tools or manual processes after the volume is created.

Configuring encryption during the volume creation ensures that all data stored on that volume is automatically encrypted. Moreover, AWS manages the encryption keys through the AWS Key Management Service (KMS), which simplifies key management and enhances security.

This approach is not only more efficient but also ensures that all data, including snapshots created from the encrypted volume, remains encrypted. Encrypting the volume at the point of creation helps maintain organizational compliance and security best practices from the outset, rather than retroactively applying encryption after data has been written, which can be more complex and may result in unprotected data during the transition.