A legacy EC2 data volume is unencrypted. The approved migration must preserve its contents on an encrypted EBS volume and allow validation before the original is retired. Which steps belong in the migration? Select 2 answers.

1. Encrypt the filesystem mount options while leaving the existing EBS volume unchanged, and report that the EBS encryption flag is enabled.
2. Detach the original and request an in-place encryption toggle on its existing volume ID.
3. Enable EBS encryption by default and assume all existing unencrypted volumes are converted in place.
4. Create an application-consistent snapshot and produce an encrypted snapshot copy using an approved KMS key.
5. Create an encrypted volume from the encrypted snapshot, attach it during a planned cutover, and validate the data and application before retiring the original.