A genomics firm runs Spark jobs on Amazon EMR handling PHI across three subnets, requiring that shuffle and node-to-node traffic remain encrypted without managing certificates on each host. Auditors require native inter-node encryption using KMS-backed keys. Which inter-resource encryption configuration meets the in-transit protection requirement?

The PHI Spark workload needs native EMR encryption of east-west shuffle and node-to-node traffic across subnets without per-host certificate management, and the correct security configuration delivers this by enabling EMR in-transit encryption (TLS certificates that EMR provisions to every node, for example EMR-managed certificates on release 7.11 or later) for intra-cluster RPC, HDFS, and shuffle, together with KMS-backed local disk encryption that protects spilled blocks on instance storage. The EBS and S3 at-rest approach fails on scope because KMS encryption of volumes and objects protects persisted data at rest but leaves internode shuffle traffic unencrypted, satisfying storage compliance while missing the in-transit mandate. The Kerberos approach fails on function because it provides mutual authentication and ticket control for cluster principals, not bulk data-plane encryption, and it does not encrypt data on the wire. The endpoint TLS approach fails on boundary because TLS to the cluster edge with ACM safeguards client-to-cluster sessions but terminates before internal distribution, leaving east-west traffic in cleartext across the three subnets. For exams, treat shuffle, inter-node, and no certificate management as triggers for EMR in-transit encryption, not at-rest or edge TLS or authentication. As a practical check, describe the EMR security configuration to confirm in-transit encryption and KMS key ARN, verify KMS grants for EMR roles, and sample internode traffic to confirm TLS.