An organization needs to protect sensitive application data currently stored in a database as plaintext. Which secrets engine provides a solution?

The Key/Value v2 secrets engine stores arbitrary secrets at rest within Vault, but it does not provide cryptographic functions for external application data.

The Cubbyhole secrets engine offers private, per-token temporary storage for secrets, primarily used for passing secrets securely, not for general application data encryption.

The Transit secrets engine allows applications to send plaintext data to Vault for encryption and receive ciphertext, or vice versa, effectively providing 'encryption as a service' without the application ever directly handling the encryption keys, thus protecting sensitive data.

The Database secrets engine dynamically generates database credentials on demand for applications, but it does not provide encryption-as-a-service for existing data within a database.