Correct answer:
Use AWS Key Management Service (AWS KMS) to centrally manage encryption keys and integrate with AWS services.

Explanation:
AWS KMS is a fully managed service designed specifically to reduce the operational burden of encryption key management. It allows you to create, rotate, disable, and audit keys easily. KMS integrates directly with most AWS services and supports access control through IAM and resource policies. It automates key rotation and provides detailed logs through AWS CloudTrail, allowing the company to enforce strong security practices without having to build or maintain a custom key management system.

Why the other options are incorrect:

AWS Certificate Manager (ACM) is primarily used to manage SSL/TLS certificates for securing HTTPS connections, not general-purpose encryption keys used by developers within applications.
IAM policies are important for access control, but by themselves they do not provide key management or encryption services. They must be used in combination with a key management solution like AWS KMS.
Multi-factor authentication (MFA) enhances user authentication security but does not address key creation, rotation, or integration with applications. It is not a key management solution and does not reduce operational burden in this scenario.

Full AWS Practitioner Certification Question