Correct Answer:
Use AWS Key Management Service (AWS KMS) to encrypt the EBS volumes and Aurora database storage at rest. Attach an AWS Certificate Manager (ACM) certificate to the ALB to encrypt data in transit.

Explanation:
This solution uses AWS-native tools that are purpose-built for encryption:

AWS KMS enables encryption of EBS volumes and Amazon Aurora storage using customer managed or AWS-managed keys, fulfilling the requirement for encryption at rest.
AWS Certificate Manager (ACM) provides and manages SSL/TLS certificates that can be used with ALBs to encrypt data in transit.

Why the other options are incorrect:

Using AWS KMS certificates on the ALB: AWS KMS does not provide SSL/TLS certificates for ALBs. ACM is the correct service for in-transit encryption with ALBs.
Using the root account to enable encryption account-wide: AWS does not offer a global setting to enable encryption for all services with a single switch. Root usage is discouraged.
Using BitLocker and importing TLS keys to KMS: BitLocker is not an AWS-native solution and cannot be applied to EC2/EBS in this way. TLS certificates should be managed with ACM, not KMS.

Full AWS Practitioner Certification Question