It doesn't make sense to say some services don't encrypt data at rest by default, for example IAM, STS, CloudHSM, and KMS. Use N/A for these fields.