What should a solutions architect do to secure the data?

A company has a customer relationship management (CRM) application that stores data in an Amazon RDS DB instance that runs Microsoft SQL Server. The company’s IT staff has administrative access to the database. The database contains sensitive data. The company wants to ensure that the data is not accessible to the IT staff and that only authorized personnel can view the data.

What should a solutions architect do to secure the data?
A . Use client-side encryption with an Amazon RDS managed key.
B . Use client-side encryption with an AWS Key Management Service (AWS KMS) customer managed key.
C . Use Amazon RDS encryption with an AWS Key Management Service (AWS KMS) default encryption key.
D . Use Amazon RDS encryption with an AWS Key Management Service (AWS KMS) customer managed key.

Answer: D