A municipal Amazon OpenSearch Service domain stores citizen feedback and must enable encryption at rest and node-to-node encryption. Which action best applies those data security controls on the service?
Select an answer to reveal the explanation.
Short Explanation
Flip on the domain’s own locks: encryption at rest for disks and node-to-node encryption for chatter between nodes. A fancy “encrypted-” nameplate without those settings is just paint.
Full Explanation
Managed data stores often expose explicit encryption-at-rest and in-transit (node-to-node) settings that architects must enable for sensitive workloads. For OpenSearch, turning on those features addresses Task 1.3 service encryption controls. Public exposure, cosmetic naming, or unencrypted exports do not substitute for domain encryption settings.