An Application Running on Multiple Amazon EC2 Instances Pulls Messages

Multiple Choice

An application running on multiple Amazon EC2 instances pulls messages from a standard Amazon SQS queue. A requirement for the application is that all messages must be encrypted at rest. Developers are instructed to use methods that allow for centralized key management and minimize possible support requirements whenever possible. Which of the following solutions supports these requirements?

A) Encrypt individual messages by using client-side encryption with customer managed keys, then write to the SQS queue.
B) Encrypt individual messages by using SQS Extended Client and the Amazon S3 encryption client.
C) Create an SQS queue, and encrypt the queue by using sewer-side encryption with AWS KMS.
D) Create an SQS queue, and encrypt the queue by using client-side encryption.