An administrator manages a Nutanix cluster hosting a mixed workload environment, including general-purpose VMs and a specific group of high-sensitivity "PCI-DSS" database servers. The cluster is currently configured with "Data-at-Rest Encryption" disabled at the global cluster level.
A new security mandate requires that all data associated with the "PCI-DSS" workloads must be encrypted at rest using a dedicated external Key Management Server (KMS) for key rotation. The general-purpose VMs, however, must remain unencrypted to avoid unnecessary encryption overhead. The administrator has already deployed and registered the required KMS instance with Prism Central.
Which sequence of configuration steps should the administrator perform in Prism Central to meet this specific encryption requirement?