Which action should the solutions architect take?

Explanations:

CloudFront signed URLs are used to grant time-limited access to specific content, but they do not provide additional protection for sensitive information at the application stack level.

CloudFront signed cookies also provide access control to resources but are not designed to encrypt sensitive data during transit. They manage access rather than add an encryption layer.

CloudFront field-level encryption allows you to encrypt sensitive data in specific fields within the request before it reaches your origin. This adds an extra layer of security for sensitive information throughout the application stack.

Setting the Origin Protocol Policy to HTTPS Only ensures that communications between CloudFront and the origin are secure, but it does not add an additional layer of encryption specifically for sensitive data at the field level.