Serverless Data Analysis with S3 CRR and SSE-S3
Answer
Correct answer: C — Use SSE-S3 for encryption and Amazon Athena for serverless querying of existing S3 data replicated via CRR.
A company wants to move its application to a serverless solution. The serverless solution needs to analyze existing and new data by using SL. The company stores the data in an Amazon S3 bucket. The data requires encryption and must be replicated to a different AWS Region. Which solution will meet these requirements with the LEAST operational overhead?
Community Insight
The exam tests the ability to distinguish between managed services (SSE-S3) and complex key management (KMS), while recognizing that Athena is the correct serverless query tool compared to RDS.
This question evaluates the optimal serverless architecture for analyzing S3 data with cross-region replication and encryption, focusing on minimizing operational overhead through SSE-S3 and Athena.
Candidates often choose Option A because they mistakenly believe SSE-KMS is required for cross-region scenarios or overlook that SSE-S3 fully supports replication with less management effort.
Community Discussion (155 comments)
M4XA
👍 1
Selected: C
Option C. Looking at the text definitely know that company uses S3 already. there is only required encryption and replication, literally nothing about decryption. As well as LEAST operational overhead. That's why C.
46e1a46
👍 2
Selected: A
WHY YOU NEED A NEW BUCKET!!! S3 Cross Region Replication only replicates objects uploaded AFTER CRR is enabled. It does not retroactively replicate objects in the bucket
607d657
👍 1
Selected: A
- Serverless Analysis: Amazon Athena is a serverless query service that lets you analyze data directly in S3 using SQL — no infrastructure to manage. - Encryption: SSE-KMS with multi-Region keys provides strong encryption and seamless replication support across Regions. - Replication: S3 CRR handles replication automatically once configured, minimizing manual effort. - Operational Simplicity: Creating a new bucket ensures clean configuration and avoids legacy settings or permissions issues.
3386cca
👍 2
Selected: A
It's A. or C because of athena. But can't be C because ❌ SSE-S3 encryption is not supported with CRR by default. You need SSE-KMS or unencrypted data for CRR.
Clouddon
👍 2
Selected: A
A. Create a new S3 bucket. Load the data into the new S3 bucket. Use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. Use server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Use Amazon Athena to query the data.
MortisG
👍 2
Selected: A
Correct answer is A. SSE-S3 is not supported for CRR.
CloudExpert01
👍 1
Selected: C
since the requirement is "The serverless solution needs to analyze existing and new data", the answer C seems to be more appropriate since all the data will be in 1 bucket
Mimine87
👍 1
Selected: A
Amazon S3 + Athena is a fully serverless data analytics solution (no infrastructure to manage). S3 Cross-Region Replication (CRR) enables automatic, asynchronous replication of objects across AWS Regions, satisfying the replication requirement. SSE-KMS with multi-Region keys ensures that the data is encrypted and can be decrypted in the destination Region, which is crucial for cross-region analytics and compliance. Athena is used for analyzing data directly in S3 using SQL, which meets the requirement to analyze existing and new data using SQL (SL was a typo). This option delivers everything with the least operational overhead — no server provisioning, no DB management, and built-in encryption + replication.
Faraz999
👍 2
Selected: A
you can apply cross-region replication to an existing Amazon S3 bucket, but it will only replicate new objects after the replication rule is configured. To replicate existing objects, you'll need to use S3 Batch Replication.
MPG1970
👍 1
Selected: A
I went for A because, if you start to encrypt only new data then 1. You will have an inconsistently solution for security. I think it fair to assume that if they want all new data encrypted, then all data should be encrypted 2. the serverless function will become more complex as it will have to establish whether the data is encrypted or not every time it retrieves an object. Therefore you need to create a new S3 bucket so that all data will be encrypted
SirDNS
👍 1
Selected: C
fewer services = less operational overhead managed services/serverless = less operational overhead
tch
👍 2
Selected: A
If you want a straightforward approach to encrypting your S3 data without managing your own encryption keys, SSE-S3 is a good option. you need AWS KMS for this complex solution
zdi561
👍 2
Selected: A
A new bucket is needed to encrypt objects. C uses existing bucket.
LeonSauveterre
👍 2
Selected: A
About typos: "kays" should be "keys", and "SL" should be "SQL". So you gotta choose between A and C (We need Athena!). About option C: SSE-S3 is a valid encryption method, just not as suitable as SSE-KMS with multi-Region keys for CRR. SSE-KMS with multi-Region keys simplifies key management in the destination Region.
Rcosmos
👍 1
Selected: U
A melhor opção para atender aos requisitos com a menor sobrecarga operacional é a opção A: A. Crie um novo bucket do S3. Carregue os dados no novo bucket do S3. Use a replicação entre regiões (CRR) do S3 para replicar objetos criptografados para um bucket do S3 em outra região. Use a criptografia no lado do servidor com chaves multirregionais do AWS KMS (SSE-KMS). Use o Amazon Athena para consultar os dados.Conclusão: A opção A é a escolha ideal, pois combina os recursos sem servidor do Amazon Athena, a segurança avançada do SSE-KMS com chaves multirregionais, e a replicação automática entre regiões com o S3 CRR, tudo com a menor sobrecarga operacional.
skylerwhite
👍 2
Selected: A
what is the different between create a new S3 bucket and load data into the existing S3 bucket? I don't get it this. Please..
Mischi
👍 2
Selected: A
Option A provides a serverless solution, advanced encryption with AWS KMS multi-region keys and cross-region replication with CRR, all with the lowest operational overhead. Amazon Athena is the ideal tool for analyzing data in S3 without the need for additional infrastructure.
Chr1s_Mrg
👍 1
Selected: C
RDS is relational DB so we need Athena for this
tonybuivannghia
👍 2
Selected: A
I think A is correct because SSE-S3 doesn't support multi-region key management, but SSE-KMS has.
PaulGa
👍 4
Selected: A
Ans A - once you realise "SL" is a typo for "ML" then its only the Athena options, and in the case of option it means setting up a new S3 bucket
llccing
👍 2
I'm curious that if the SL is the typo of "SQL"?
MatAlves
👍 2
Selected: C
"Unencrypted objects and objects encrypted with SSE-S3 are replicated by default." (stephane maarek course)
appltsla
👍 2
Selected: A
gpt-4 says A
ChymKuBoy
👍 2
Selected: C
C for sure
CCCat
👍 3
Selected: C
Since S3 has provides the automatic encryption for the storage objects, create another bucket is redundant, C has the least operational overhead.
SAgang
👍 2
from your link you missed this part: you can encrypt data in one AWS Region and decrypt it in a different AWS Region without re-encrypting or making a cross-Region call to AWS KMS
ManikRoy
👍 2
Selected: A
What do mean by 'load the data into the existing bucket' ! the data is already staying in the existing bucket !
ChinthaGurumurthi
👍 1
The question says 'existing and new data'
Solomon2001
👍 2
Selected: A
Option B suggests using Amazon RDS to query the data, which introduces additional complexity compared to using Amazon Athena. Option C suggests using server-side encryption with Amazon S3 managed encryption keys (SSE-S3) instead of AWS KMS multi-Region keys, which might not meet the encryption requirements. Option D also suggests using Amazon RDS to query the data, which, as mentioned earlier, is not the best choice for a serverless solution and would result in higher operational overhead.
cheroh_tots
👍 2
The answer is A because SSE-S3 does not support cross-region replication of encrypted data. If you perform cross-region replication, you will have to re-encrypt the data.
suryansb
👍 2
Selected: A
awai it is correct
thewalker
👍 4
Selected: C
As per Amazon Q: The easiest way to encrypt existing objects in S3 is to use server-side encryption with S3-managed keys (SSE-S3). Here are the basic steps: 1. Enable SSE-S3 on the target S3 bucket if it is not already enabled. This will ensure all new or copied objects are encrypted automatically. 2. Create an S3 inventory report for the source bucket containing the objects. This will generate a CSV file with metadata of all objects. 3. Use S3 Select or AWS Athena to query the inventory report and filter for only unencrypted objects. 4. Create an S3 Batch Operations job to copy the filtered unencrypted objects to the target bucket. The copy operation will automatically encrypt the objects using the bucket's SSE-S3 configuration.
thewalker
👍 2
5. Monitor the job completion to ensure all objects were encrypted. You can optionally delete the original unencrypted versions after verifying successful encryption. This approach minimizes disruption and performs the encryption without having to rewrite existing data or code. Also Refer: https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-ops-copy-example-bucket-key.html
pentium75
👍 7
Selected: C
Data in S3 is queried with Athena, not RDS, thus B and D are out. A requires a new bucket and loading data into that - Why, since data is already in S3? It says to enable CRR only after loading the data, so existing data won't be replicated anyway. C uses existing data (less operational overhead compared to loading data into a new bucket) and SSE-E3 (less operational overhead than SSE-KMS).
LoXoL
👍 2
Most clear explanation. Thanks!
LeonSauveterre
👍 1
True, but how do you use SSE-S3 with multi-Region keys for CRR?
DHADD003
👍 3
Selected: A
I selected A because SSE-S3 keys are not multi-regional keys. You must use SSE-KMS for the multi-regional keys and then for serverless its Aurora.
pentium75
👍 4
It says "data requires encryption", not that it must use same key in both regions.
djgodzilla
👍 4
Selected: A
The most suitable solution with the least operational overhead for the company's requirements is: Option A: Create a new S3 bucket. Load the data into the new S3 bucket. Use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. Use server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Use Amazon Athena to query the data. This option aligns with the specified requirements of encrypting the data, replicating it to a different AWS Region, and utilizing serverless querying with Amazon Athena. It also minimizes operational overhead by leveraging AWS managed services.
SaurabhTiwari1
👍 2
Selected: A
A is correct - SSE-KMS is multi region keys and Athena is serverless for analyze C is incorrect - SSE-S3 is region specific for encryption
kmargaronis
👍 4
Selected: C
C. is correct after January 2023 because "Amazon S3 now applies server-side encryption with Amazon S3 managed keys (SSE-S3) as the base level of encryption for every bucket in Amazon S3. Starting January 5, 2023, all new object uploads to Amazon S3 are automatically encrypted at no additional cost and with no impact on performance. "
chasingsummer
👍 2
Selected: C
SSE-S3 is the easiest to use and offers strong encryption, while SSE-C provides more control over your encryption keys (and much more admin overhead)
ale_brd_111
👍 2
Selected: C
Therefore, the most appropriate solution to meet the requirements of the serverless application is to load the data into the existing S3 bucket. Use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Use Amazon Athena to query the data. This solution effectively leverages the existing S3 bucket, S3 Cross-Region Replication for data replication, SSE-S3 for encryption, and Amazon Athena for efficient data querying, enabling the company to analyze existing and new data with minimal management effort and a serverless architecture.
ale_brd_111
👍 2
Selected: A
the most appropriate solution to meet the requirements of the serverless application is to load the data into the existing S3 bucket. Use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Use Amazon Athena to query the data. This solution effectively leverages the existing S3 bucket, S3 Cross-Region Replication for data replication, SSE-S3 for encryption, and Amazon Athena for efficient data querying, enabling the company to analyze existing and new data with minimal management effort and a serverless architecture.
BhavyaMPatel
👍 2
Selected: C
right answer should be c as we need less overhead and if we are using sse-s3 then encrypted object and object encrypted with sse-s3 replicate by default for object encrypted with sse-kms Specify which KMS Key to encrypt the objects within the target bucket we need to adapt the KMS Key Policy for the target key,An IAM Role with kms:Decrypt for the source KMS Key and kms:Encrypt for the target KMS Key,we might get KMS throttling errors, in which case you can ask for a Service Quotas increase so less operation is in c option so right answer should be c
sofodofo
👍 2
Selected: C
Seems like C - refer to https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-config-for-kms-objects.html#replication-default-encryption <How default bucket encryption affects replication> When you enable default encryption for a replication destination bucket, the following encryption behavior applies: - If objects in the source bucket are not encrypted, the replica objects in the destination bucket are encrypted by using the default encryption settings of the destination bucket. As a result, the entity tags (ETags) of the source objects differ from the ETags of the replica objects. If you have applications that use ETags, you must update those applications to account for this difference.
RNess
👍 1
Selected: A
https://aws.amazon.com/blogs/storage/encrypting-existing-amazon-s3-objects-with-the-aws-cli/#:~:text=To%20encrypt%20an%20existing%20object,data%20using%20server%2Dside%20encryption.
tom_cruise
👍 4
Selected: A
"To encrypt an existing object using SSE, you replace the object. To encrypt existing objects in place, you can use the Copy Object or Copy Part API. This copies the objects with the same name and encrypts the object data using server-side encryption." https://aws.amazon.com/blogs/storage/encrypting-existing-amazon-s3-objects-with-the-aws-cli/#:~:text=To%20encrypt%20an%20existing%20object,data%20using%20server%2Dside%20encryption.
DamyanG
👍 1
Selected: C
Answer C I think
JKevin778
👍 3
Selected: C
Athena to query from S3. SSE-S3 is least operation overhead than SSE-KMS so, C.
hieulam
👍 1
Selected: A
The question should be A. https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-what-is-isnot-replicated.html#:~:text=Objects%20created%20after%20you%20add%20a%20replication%20configuration.
XCheng
👍 2
C https://docs.aws.amazon.com/zh_cn/AmazonS3/latest/userguide/bucket-encryption.html#bucket-encryption-replication
frankie270299
👍 1
Selected: C
i think C is correct answer,i asked chatgpt
TariqKipkemei
👍 5
Selected: A
Technically both A and C will work, but there is a requirement for 'LEAST operational overhead'. Multi-Region keys are a flexible and powerful solution for many common data security scenarios such as this: Global data management Businesses that operate globally need globally distributed data that is available consistently across AWS Regions. You can create multi-Region keys in all Regions where your data resides, then use the keys as though they were a single-Region key without the latency of a cross-Region call or the cost of re-encrypting data under a different key in each Region.
Jeyaluxshan
👍 5
If you use S3 managed encryption key , it will apply to newly uploaded objects, not to existing objects. C & D is wrong. which state use existing bucket. Athena is to query in S3 so no need of RDS. B is wrong. Correct Answer is A - use KMS key
AKBM7829
👍 1
C is right Answer
NSA_Poker
👍 1
"you manage the multi-Region key in each Region independently. Neither AWS nor AWS KMS ever automatically creates or replicates multi-Region keys into any Region on your behalf. AWS managed keys, the KMS keys that AWS services create in your account for you, are always single-Region keys." https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
sohailn
👍 2
C is the best answer because encrypted s3 replication is not as simple, if you have an unencrypted data or encrypted with sse-s3 it will replicate by default. if you have encrypted sse-c client side encryption it will not replicate at all because you need to access the key all the time. if you encrypted with sse-kms by default it will not encrypt from source to target by default you ll need to perform addition steps and we cant use KMS-Multi key because aws s3 still consider it independent key, so you must first need to decrypt the data in source bucket and reencrypt in target bucket this solution is 100% true as per stephen udemy instrcutor.
GC2023
👍 1
Please remember that enabling encryption on a bucket does not retroactively encrypt existing objects. You would need to perform a copy operation to re-upload existing objects with encryption enabled if you want to ensure that all objects are encrypted(from chatGPT)
Fielies23
👍 3
As a side note, if a bucket already exists and you enable replication, you CAN actually now also replicate the existing object in the bucket with "Amazon S3 Batch Replication". https://aws.amazon.com/blogs/aws/new-replicate-existing-objects-with-amazon-s3-batch-replication/#:~:text=S3%20Replication%20is%20a%20fully,or%20to%20multiple%20destination%20buckets.
RupeC
👍 3
Selected: C
A and C are valid, but C has less overhead and the key management is also serverless.
Chiznitz
👍 3
Answer A has you move the data before you enable replication, therefore there is no difference between A and C when it comes to the point in time you enable replication. I agree A would be a better choice if the order of operations said, create a bucket->Enable encryption->move files...but it doesn't. It has you create the bucket and move the files.
pentium75
👍 3
Which is the same in A and C. In A you create a new bucket, but still you load the existing data into the new bucket before enabling replication.
fuzzycr
👍 1
Selected: A
without any changes to your client applications
MNotABot
👍 1
A KMS will give least operational overhead as it needs key rotation in 3 years which is 1 year in S3-SSE
sosda
👍 2
Selected: C
SSE-S3 less operational overhead
jaydesai8
👍 1
Selected: A
A, since we can use multi-keys in another region with aws kms keys
ajchi1980
👍 2
Selected: C
This option minimizes operational overhead because it uses the existing S3 bucket, avoiding the need to create a new one. The data is encrypted using server-side encryption with SSE-S3, which simplifies key management as the encryption keys are managed by Amazon S3. The replication of encrypted objects to another region is handled through S3 Cross-Region Replication (CRR), which automates the process without requiring additional configuration or maintenance. For data analysis, Amazon Athena can be used to query the data directly from the S3 bucket, providing a serverless analytics solution. Athena supports querying data in S3 using standard SQL queries, making it a suitable choice for analyzing the data without the need for provisioning and managing database infrastructure.
MutiverseAgent
👍 2
Replication does not work for existing objects, only for new ones.
cookieMr
👍 1
Selected: A
It creates a new S3, allowing for isolation and organization of the data in a serverless solution. S3 CRR is used to automatically replicate the encrypted objects to an S3 in another Region, providing data replication and disaster recovery capability. SSE-KMS ensures the encryption of data at rest with a secure key management service. Athena is a serverless query service that enables analyzing data in S3 using SQL queries without the need for managing infrastructure. It allows for easy analysis of the existing and new data. Option B suggests using Amazon RDS to query the data. However, Amazon RDS is a managed relational database service and not suitable for analyzing data stored in S3 directly. Option C suggests using server-side encryption with Amazon S3 managed encryption keys (SSE-S3). While SSE-S3 provides encryption, using SSE-KMS with multi-Region keys offers better control and security for data encryption. Option D also suggests using Amazon RDS to query the data, which is not the most suitable service for analyzing data in S3.
beginnercloud
👍 1
Selected: C
C is correct. https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
northyork
👍 1
answer c: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
northyork
👍 1
Answer is C: By default, Amazon S3 doesn't replicate objects that are stored at rest using server-side encryption with KMS keys. To replicate encrypted objects, you modify the bucket replication configuration to tell Amazon S3 to replicate these objects. https://www.examtopics.com/exams/amazon/aws-certified-solutions-architect-associate-saa-c03/view/14/
northyork
👍 1
https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-walkthrough-4.html
th3k33n
👍 2
Selected: A
Since sse-s3 is owned by aws, it will take care of decryption upon replication because you need to re-encrypt the object again in the new region so, A
pedroso
👍 1
Selected: C
Question says "LEAST operational overhead" and that is the one that is configured by default. The KMS is other level of security but have additional cost and additional operational effort. To upload the object you will need to identify the KMS key you want to use and to access the object you will (again) to identify the KMS key you want to use. All Amazon S3 buckets have encryption configured by default, and objects are automatically encrypted by using server-side encryption with Amazon S3 managed keys (SSE-S3). This encryption setting applies to all objects in your Amazon S3 buckets. If you need more control over your keys, such as managing key rotation and access policy grants, you can choose to use server-side encryption with AWS Key Management Service (AWS KMS) keys (SSE-KMS).
Bmarodi
👍 1
Kays = keys, mistype i think.
studynoplay
👍 2
Folks who chose A, why do you need a new S3 bucket? Please explain
D10SJoker
👍 1
You need to creat a new bucket in a different Region because the replication works for new objects and not existing ones, so that leaves answer A as the only right option.
rushi0611
👍 2
Selected: C
Answer C: No where asked to have the same keys to be used for decryption and also to audit, main aim is to reduce operational overhead- so only with sse-s3 this is possible.
Nicknameinvalid
👍 18
Selected: A
Option C is not the best solution because it uses server-side encryption with Amazon S3 managed encryption keys (SSE-S3), which is not multi-Region. This means that the encryption key will only be available in the Region where the S3 bucket resides and cannot be replicated to another Region. As a result, if the bucket needs to be replicated to another Region, it will require extra steps to ensure that the encryption keys are also available in the new Region. In contrast, option A uses server-side encryption with AWS KMS multi-Region keys (SSE-KMS), which can be replicated to another Region and makes it easier to manage the encryption keys in a multi-Region setup.
chibaniMed
👍 3
Selected: A
its A and not C beacause the question dosent mention if data is already encrypdted or not. that's why the solution A can be used for both cases.
KarimaMaf
👍 2
• S3 Replication Encryption Considerations: ○ Unencrypted objects and objects encrypted with SSE-S3 are replicated by default ○ Objects encrypted with SSE-C (customer provided key) are never replicated ○ For objects encrypted with SSE-KMS, you need to enable the option cause by default is not replicated you should enable and decrypt before send to target and encrypt in the target: § Specify which KMS Key to encrypt the objects within the target bucket § Adapt the KMS Key Policy for the target key § An IAM Role with kms:Decrypt for the source KMS Key and kms:Encrypt for the target KMS Key § You might get KMS throttling errors, in which case you can ask for a Service Quotas increase ○ You can use multi-region AWS KMS Keys, but they are currently treated as independent keys by Amazon S3 (the object will still be decrypted and then encrypted) so it's C
darn
👍 1
Selected: C
existing bucket and SSE-S3
kels1
👍 13
Crap man! I hate these at 51/49 % where's the truth man? I'm just here to study... lol :)
cokutan
👍 3
the thoughts of my mind as well:)
studynoplay
👍 3
So many controversial questions
Robrobtutu
👍 3
This is a tricky one. C would have less operational overhead, but CRR doesn't encrypt already existing objects, so you'd need to create a new bucket, upload the existing data to the new bucket, and then encrypt the bucket.
ErnShm
👍 1
You can replicate existing bucket with all the objects, you do not need to create a new one for that challenge
C_M_M
👍 1
A key issue in this question is the fact that the existing data on S3 requires encryption. Meaning it is currently unencrypted. So which is easier? to create a new S3 and move the data or go through the process of encrypting already existing unencrypted data. I will just create new S3.
Musti35
👍 2
Selected: A
SSE-S3 only encrypt new data but you can encrpyt existing and new data with SSE-KMS
nazirlia
👍 3
Selected: C
Option C provides a correct solution that meets the given requirements with the least operational overhead. Data is loaded into the existing S3 bucket, and the S3 Cross-Region Replication (CRR) feature is used to replicate the data to an S3 bucket in a different AWS region. The data is encrypted server-side using Amazon S3 managed encryption keys (SSE-S3). Amazon Athena can be used to query the data.
channn
👍 2
Selected: C
choose C as no need to create a new S3.
TECHNOWARRIOR
👍 2
Solution A and C are both workable options, while Solution B is not a feasible option for the requirements given. Solution A and C both utilize S3 Cross-Region Replication and server-side encryption with Amazon S3, and both use Amazon Athena for querying the data. However, Solution A involves creating a new S3 bucket, which requires extra effort and network costs, while Solution C uses the existing S3 bucket. On the other hand, Solution C uses SSE-S3 encryption, which is limited to the region where the data resides, while Solution A uses AWS KMS multi-region keys for encryption, which ensures secure data handling across regions. Therefore, Solution A may be a better option if disaster recovery across regions is a priority.
nauman001
👍 1
Read the question carefully: I think the only difference is Bucket Presence in .... A: There is no bucket create the bucket and upload the data. and in C: Bucket already created and customer upload the data into existing bucket. In both ways New data is uploaded which is encrypted and CRR applies on it.
kraken21
👍 2
Selected: A
Selected A as for S3 CRR only new objects are replicated and this means additional overhead using Answer:C.
Erbug
👍 1
Selected: C
why do we need SSE-S3 and not SSE-KMS for this solution? What are the differences between them?
asoli
👍 3
Selected: A
it says existing objects and new objects. When you enable cross-region replication on an s3 bucket, it only replicates the new objects and you have to take care of the existing objects to copy them to the new bucket. which has more operational overhead.
ChandraPrabu
👍 4
Selected: A
Existing objects in the source bucket will not be replicated to the destination bucket unless you manually copy them to the destination bucket or use another method such as Amazon S3 inventory and Amazon S3 batch operations. In that case option A makes sense to copy the exiting data to new bucket & make them replicated in destination bucket.
rdss11
👍 1
Selected: C
S3 buckets are ecrypted by SSE-S3 by default
athiha
👍 7
Selected: A
The only reason why I choose option A is that the question states "Serverless Solutions needs to analyze existing and new data". And when you turn on the Cross-Region Replication (CRR), the existing data will not be replicated automatically. It only replicates the new data added to the source bucket from the point you turn on CRR. So it would make more sense to have a new bucket to load the data and then turn on the CRR.
KZM
👍 1
Selected: C
Multi-Regions Key in AWS KMS https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
KZM
👍 3
A, Sorry, I wrongly clicked on C. I mean option A, AWS KMS multi-Region kays.
Ja13
👍 1
Selected: C
It says that they already have a S3 bucket, option A indicates to create a new one. Why would they create a new bucket when they already have one? option c is better
CapJackSparrow
👍 1
Cross region replication is not retro-active.
LuckyAro
👍 2
Selected: A
A is the best solution that meets the company's requirements with the least operational overhead. A recommends creating a new S3 bucket, loading the data into the new S3 bucket, using S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another region, using server-side encryption with AWS KMS multi-Region keys (SSE-KMS), and using Amazon Athena to query the data.
bdp123
👍 2
Selected: A
It doesn't state whether the Existing S3 bucket might have uncrypted data - encryption will apply new data received after the applying of encryption on the new bucket.
joric
👍 1
Selected: C
I vote C , key word existing data
joric
👍 1
The serverless solution needs to analyze existing and new data by using SL. (SQL) there is a misstype.
KZM
👍 2
Amazon S3 now applies server-side encryption with Amazon S3 managed keys (SSE-S3) as the base level of encryption for every bucket in Amazon S3. Starting January 5, 2023, all new object uploads to Amazon S3 will be automatically encrypted at no additional cost and with no impact on performance. Server-side encryption with AWS KMS keys (SSE-KMS) is similar to SSE-S3, but with some additional benefits and charges for using this service. If we think about the LEAST operational overhead, SSE-S3 is more reasonable, I think.
joric
👍 1
I mean I askesd whats SL? is it a typing mistake? admins unlock my comment please.
Joxtat
👍 2
Its a TYPO for SQL
joric
👍 1
I asked what is ML. admins unlock my comment please.
Lemmij
👍 1
Machine Language
kerl
👍 6
Answer is C, i have manually tested using SS3-S3 for encryption and test the relication and it work. For existing data, before u save your replication rules, S3 will asked if u want to replicate existing data to a new S3 bucket using Batch Operation Job.
ASODAD
👍 1
Selected Answer: C Unencrypted objects and objects encrypted with SSE-S3 are replicated by default
joric
👍 2
" analyze existing and new data by using SL." what is SL ? never heard before
micola
👍 1
Selected: C
By default, Amazon S3 doesn't replicate objects that are stored at rest using server-side encryption with customer managed keys stored in AWS KMS. ... You can use multi-Region AWS KMS keys in Amazon S3. However, Amazon S3 currently treats multi-Region keys as though they were single-Region keys, and does not use the multi-Region features of the key. For more information, see Using multi-Region keys in AWS Key Management Service Developer Guide. https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-config-for-kms-objects.html so between A and C I'm choosing C, as it has less overhead
simplimarvelous
👍 3
So would have to go with answer A this with this question. - with no specific information telling that existing data is encrypted a new bucket should be created so that new data will be encrypted. By default existing encrypted at rest object are not replicated without having to having to do additional work to tell S3 to replicate it. https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-walkthrough-4.html The documentation does say the following: https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-bucket-encryption.html Changes to note before enabling default encryption SSE-S3 After you enable default encryption for a bucket, the following encryption behavior applies: "There is no change to the encryption of the objects that existed in the bucket before default encryption was enabled."
remand
👍 1
Selected: C
The solution that meets these requirements with the least operational overhead is option C. By loading the data into the existing S3 bucket, it eliminates the need to create a new S3 bucket and move data to it. S3 Cross-Region Replication (CRR) can then be used to replicate encrypted objects to an S3 bucket in another Region. Server-side encryption with Amazon S3 managed encryption keys (SSE-S3) can be used to encrypt the data. Finally, Amazon Athena can be used to query the data which is a serverless, interactive query service that makes it easy to analyze data in Amazon S3 using standard SQL.
Ello2023
👍 1
Selected: C
Athena is Used to analyse and query petabytes of data or build application on S3, on-premises and other. Serverless Only pay when run
lfrad
👍 4
Selected: A
My question is about CRR: since we need to replicate all data both new and old, shouldn't the existing bucket option be out of the window as CRR does not replicate already present data but only new PUTs ? In this case the question would trick you into answering C as SSE-S3 is less operational overhead over SSE-KMS, BUT it not a feasible architecture as the CRR choice (instead of say batch replication or s3 sync command) would not allow existing data to be transferred. So SSE-S3 better, but C is not feasible... so A ?
aba2s
👍 2
Selected: A
I vote for A
Zerotn3
👍 2
Selected: C
LEAST operational overhead
Buruguduystunstugudunstuy
👍 2
Selected: C
The solution that meets the requirements with the least operational overhead is Option C: Load the data into the existing S3 bucket. Use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. Use server-side encryption with Amazon S3-managed encryption keys (SSE-S3). Use Amazon Athena to query the data. Option C avoids the need to create a new S3 bucket, which reduces operational overhead. Additionally, using Amazon Athena to query the data allows for efficient querying of the data stored in the S3 bucket without the need to set up and maintain a separate database instance.
waiyiu9981
👍 3
Can anyone tell me a solid answer on this lol. The voting is way too close as 50/50
Buruguduystunstugudunstuy
👍 2
The correct answer is Option C. To meet the requirements with the least operational overhead, the company should load the data into the existing S3 bucket and use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. The company should use server-side encryption with Amazon S3-managed encryption keys (SSE-S3) and use Amazon Athena to query the data. Using S3 Cross-Region Replication (CRR) will allow the company to replicate the encrypted data to a different AWS Region automatically, which will provide the company with a disaster recovery solution. Using server-side encryption with Amazon S3 managed encryption keys (SSE-S3) will allow the company to encrypt the data without having to manage the keys. Amazon Athena is a fully managed, serverless query service that allows users to analyze data stored in S3 using SQL. By using Athena, the company can analyze the data without having to provision and manage any infrastructure.
techhb
👍 1
I am goingvwith SSE-S3.
career360guru
👍 2
Selected: A
Enabling CRR requires versioning to be enabled on the bucket so it is better option to create a new bucket as it may have undesired effect on existing bucket. Athena is serverless with least operational overhead for Analytics that can directly read data from S3.
Certified101
👍 3
Selected: A
"The serverless solution needs to analyze existing and new data by using SL" So this means there is unencrypted data in the existing s3 bucket due to the encryption solution not yet in place. We will need a new S3 bucked
lapaki
👍 3
Selected: A
A. Agree with others that it’s reasonable to assume current setup has unencrypted data. Must create new bucket to set default encryption on all items going forward.
kmliuy73
👍 2
No mention of existing data being encrypted !!!
Amaris
👍 3
Selected: A
it's not C because it is not achieving the goal of encrypting all objects, hence A
Wajif
👍 6
Selected: A
Athena being serverless and offers less operational overhead so ruling out B&D. C: SSE-S3 has higher operational overhead but it doesnt achieve the GOAL which is to encrypt all objects. Hence the answer is A: https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-bucket-encryption.html "Changes to note before enabling default encryption After you enable default encryption for a bucket, the following encryption behavior applies: There is no change to the encryption of the objects that existed in the bucket before default encryption was enabled."
JayanKuruwita
👍 1
Selected: C
C would be hard if we have to replicate set of existing objects, because we need AWS support assistance for that. But this is about new objects that we are going to upload to S3. Thinking about setting up permissions for KMS key with SSE-KMS mode. I would go with C.
justtry
👍 3
Selected: A
https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-bucket-encryption.html There is no change to the encryption of the objects that existed in the bucket before default encryption was enabled.That's the reason why new bucket should be created.
Wpcorgan
👍 2
A is correct for me
Onimole
👍 1
C appears to be right
Ohnet
👍 2
It is A: https://aws.amazon.com/blogs/storage/replicating-existing-objects-between-s3-buckets/
study_aws1
👍 4
The issue with Option C) is the existing data before setting up CRR will not be replicated and that is why option A) looks good. The question does not talk of employing S3 Batch Replication before CRR is setup.
backbencher2022
👍 3
Selected: A
A is the solution with least operational overhead
masetromain
👍 5
Selected: A
for me the answer is A: The Existing S3 bucket might have uncrypted data - encryption will apply new data received after the applying of encryption on the new bucket.
dokaedu
👍 33
Answer is A: Amazon S3 Bucket Keys reduce the cost of Amazon S3 server-side encryption using AWS Key Management Service (SSE-KMS). This new bucket-level key for SSE can reduce AWS KMS request costs by up to 99 percent by decreasing the request traffic from Amazon S3 to AWS KMS. With a few clicks in the AWS Management Console, and without any changes to your client applications, you can configure your bucket to use an S3 Bucket Key for AWS KMS-based encryption on new objects. The Existing S3 bucket might have uncrypted data - encryption will apply new data received after the applying of encryption on the new bucket.
AKBM7829
👍 3
But in server side encryption Multi Region Keys is not possible which leaves to Option C
MutiverseAgent
👍 2
Both answers A & C can be possible from the certificate perspective because in both regions will be certificates to encrypt/decrypt, SSE-KMS and SSE-S3 respectively. But the difference is that replication works for new objects and not existing ones, so that leaves answer A as the only right option.
ruqui
👍 2
If you want to use the cost argument: SSE-S3 is free so it's cheaper than any other encryption solution (all of the others have a cost), so the answer should be C
s50600822
👍 2
Don't know what "kays" are, could they be a trap?
LuckyAro
👍 6
I didn't read anywhere in the question where cost was an issue of consideration, so how you made it a main issue here is beyond me.
RBSK
👍 2
Cost reduction is in comparison bet Bucket level KMS key and object level KMS key. Not between SSE-KMS and SSE-S3. Hence its a wrong comparison
RODROSKAR
👍 6
Reducing cost was never the target, it's LEAST operational. In that regard SSE-S3 AWS fully managed.
UWSFish
👍 4
The question should read "SQL" not "SL"
dave9994
👍 2
Selected: C
C has fewer ops. overhead. and the question says the customer has an existing S3 bucket. Then there is no need to create a new S3 bucket.
123jhl0
👍 68
Selected: C
SSE-KMS vs SSE-S3 - The last seems to have less overhead (as the keys are automatically generated by S3 and applied on data at upload, and don't require further actions. KMS provides more flexibility, but in turn involves a different service, which finally is more "complex" than just managing one (S3). So A and B are excluded. If you are in doubt, you are having 2 buckets in A and B, while just keeping one in C and D. https://s3browser.com/server-side-encryption-types.aspx Decide between C and D is deciding on Athena or RDS. RDS is a relational db, and we have documents on S3, which is the use case for Athena. Athena is also serverless, which eliminates the need of controlling the underlying infrastructure and capacity. So C is the answer. https://aws.amazon.com/athena/
MutiverseAgent
👍 1
It'a since replication works for new objects but not for the existing ones, untless you use batch replication which is not the case.
markw92
👍 2
See comment from Nicknameinvalid below. You get your answer.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option C is the correct answer because it leverages Amazon S3 managed encryption keys (SSE-S3) and Amazon Athena, both of which are fully managed, serverless services requiring zero infrastructure maintenance. SSE-S3 automatically encrypts objects at rest and works seamlessly with S3 Cross-Region Replication (CRR) without the operational burden of managing KMS keys or permissions. Athena allows for ad-hoc SQL queries directly against data in S3, fitting the 'serverless analysis' requirement perfectly.Why the Other Options Are Wrong
Options B and D are incorrect because Amazon RDS is a relational database service, not a serverless analytics tool for raw S3 data; querying S3 directly with Athena is far more appropriate. Option A is incorrect because it involves creating a new bucket and using SSE-KMS. While KMS offers flexibility, it introduces higher operational overhead due to key rotation, permission policies, and potential latency from API calls. Additionally, starting with a new bucket ignores the existing data unless a specific migration step is taken, whereas Option C uses existing data.Community Comment Notes
Community consensus strongly favors Option C, with users noting that SSE-S3 is fully managed by AWS and requires no key management overhead compared to KMS. One user verified that SSE-S3 works correctly with CRR, debunking myths that KMS is mandatory for replication. Another user highlighted that Athena is the standard serverless query engine for S3, ruling out RDS immediately. The discussion clarified that 'least operational overhead' prioritizes fully managed defaults like SSE-S3 over customizable but complex KMS setups.Official Reference
Exam Strategy
When asked for 'least operational overhead,' always prioritize fully managed services (like SSE-S3, Lambda, Athena) over self-managed or partially managed ones (like KMS, EC2). Identify keywords like 'serverless' to rule out traditional compute or database services like RDS or EC2.
Frequently Asked Questions
Why is SSE-S3 better than SSE-KMS for this scenario?
SSE-S3 is fully managed by AWS, requiring zero key management overhead. SSE-KMS requires managing key permissions, rotation, and incurs API call costs, increasing operational complexity.
Can Amazon Athena be used to query encrypted S3 data?
Yes, Athena automatically handles decryption if the data is encrypted with SSE-S3 or SSE-KMS, provided the IAM role has access to the data and keys.
Related Analysis
Practice All SAA-C03 Questions
Access 120 questions with complete answers and detailed explanations.
View Full SAA-C03 Practice Test →