Which S3 encryption, replication, and serverless SQL design has least overhead?

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls. Determine high-performing and/or scalable storage solutions.

Short answer

C Configure CRR on the existing S3 bucket with SSE-S3 and query replicated data with Athena, avoiding new-bucket migration and KMS key management.

Question

A company wants to move its application to a serverless solution. The serverless solution needs to analyze existing data and new data by using SQL. The company stores the data in an Amazon S3 bucket. The data must be encrypted at rest and replicated to a different AWS Region.
Which solution will meet these requirements with the LEAST operational overhead?
  1. Create a new S3 bucket that uses server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Configure Cross-Region Replication (CRR). Load the data into the new S3 bucket. Use Amazon Athena to query the data.
  2. Create a new S3 bucket that uses server-side encryption with Amazon S3 managed keys (SSE-S3). Configure Cross-Region Replication (CRR). Load the data into the new S3 bucket. Use Amazon RDS to query the data.
  3. Configure Cross-Region Replication (CRR) on the existing S3 bucket. Use server-side encryption with Amazon S3 managed keys (SSE-S3). Use Amazon Athena to query the data. Correct Answer
  4. Configure S3 Cross-Region Replication (CRR) on the existing S3 bucket. Use server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Use Amazon RDS to query the data.

Key Takeaways

The exam tests whether you can separate serverless SQL from Amazon RDS and recognize SSE-S3 plus CRR as lower overhead than building a new KMS multi-Region key bucket; the trap is assuming KMS multi-Region keys are mandatory for CRR.

This SAA-C03 question tests the least-overhead way to encrypt, cross-Region replicate, and SQL-query data in Amazon S3. It establishes that configuring CRR on the existing bucket with SSE-S3 and querying through Amazon Athena (C) avoids new-bucket migration and KMS key management.

Common mistake: Many learners pick A because they believe CRR requires KMS multi-Region keys, but SSE-S3-encrypted objects can be replicated with CRR and need no KMS key policy or multi-Region key administration.

Expert Analysis

Why the Answer Is Correct

Option C keeps the existing S3 bucket, so there is no new bucket creation or data reload. SSE-S3 provides encryption at rest with S3-managed keys, and CRR supports SSE-S3-encrypted objects without KMS key policy or multi-Region key management, which keeps operational overhead lowest. Amazon Athena is serverless and runs SQL directly over S3, satisfying the requirement to analyze both existing and new data. This combination best matches the question's explicit least-operational-overhead constraint.

Why the Other Options Are Wrong

A adds a new bucket and a data-loading step, and SSE-KMS multi-Region keys add key administration even though CRR does not require them when SSE-S3 is used. B and D use Amazon RDS, which is not serverless and requires database capacity, schema, and ongoing management; RDS also does not directly query S3 objects with SQL. D layers KMS multi-Region keys on top of RDS, increasing both key and database overhead. Although C does not spell out the destination bucket, a CRR configuration necessarily names one; its key differentiators are no migration and SSE-S3.

Community Comment Notes

LeonSauveterre's reasoning is sound: using the existing bucket helps "eliminate the need to create a new bucket and load data into it," and RDS is not serverless. FlyingHawk and dce7e4b focus on KMS multi-Region keys, but AWS documentation treats those as one supported pattern for SSE-KMS replication, not a mandatory requirement for all CRR. tch and yangbo correctly note that SSE-S3 is the default, simpler encryption choice; the key exam point is that SSE-S3 does not block cross-Region replication.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When "least operational overhead" appears, first eliminate options that require new buckets, data reloads, or RDS management. Then confirm the remaining option uses a serverless query engine and an encryption method that CRR supports without extra key-policy work.

Frequently Asked Questions

Why doesn't CRR require KMS multi-Region keys with SSE-S3?

S3 CRR supports SSE-S3 objects and encrypts replicas with S3-managed keys, so no KMS key policy or multi-Region key administration is needed.

Why is Amazon RDS wrong for querying S3 data here?

RDS is a managed relational database, not a serverless query engine over S3, and it adds instance, schema, and database operations that Athena avoids.

More SAA-C03 FAQ →

Discussion 20 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 20

  1. LeonSauveterre 👍 9 Answered C
    A - A new bucket + KMS multi-Region keys = Too much operational oversight. B - RDS is not a serverless solution C - By using the existing S3 bucket, you eliminate the need to create a new bucket and load data into it. D - Athena supports querying using SQL, so that rules out RDS.
  2. dhewa 👍 7 Answered A
    A wins because it gives us encryption with AWS KMS multi-Region keys
  3. FlyingHawk 👍 5 Answered A
    Amazon S3 managed keys is region specific, for CRR, we must use KMS mult-region keys. https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
  4. komorebi 👍 4 Answered A
    Answer is A
  5. Abdullah2004 👍 3 Answered A
    A is correct
Show 15 more comments
  1. Anyio 👍 2 Answered C
    The correct answer is C. Explanation: Option A: Incorrect. Although using AWS KMS multi-Region keys (SSE-KMS) and Amazon Athena to query the data meet the security and SQL querying requirements, creating a new S3 bucket and handling data migration increases operational overhead unnecessarily if the data already exists. Option C: Correct. Configuring Cross-Region Replication (CRR) on the existing S3 bucket makes efficient use of existing infrastructure and leverages server-side encryption with Amazon S3 managed keys (SSE-S3) to ensure data encryption at rest with lower operational complexity and costs compared to using KMS keys. Using Amazon Athena allows querying the data directly in S3, offering serverless and flexible SQL querying capabilities with minimal setup and operational overhead.
  2. FlyingHawk 👍 2
    I checked AI, ChatGPT, Gemini , Claudi AI and DeepSeek think A is correct, but meta AI thinks C is correct. SSE-S3 is the default encryption, it will be least operational effort for sure. but with SSE-S3 (server-side encryption with S3-managed keys), AWS manages the encryption keys, and each region will use its own region-specific encryption key. There is no shared key between the source and destination buckets. AWS handles encryption and decryption seamlessly in each region. This approach is operationally simple but lacks control and consistency for encryption keys across regions.
  3. JA2018 👍 2 Answered C
    I will chose Option C for the following reasons: #1: Least operational overhead: Choosing "SSE-S3" over "SSE-KMS" minimizes operational overhead as it automatically manages encryption keys within S3, eliminating the need for additional KMS key management. #2: Existing S3 bucket: Reusing the existing bucket avoids the extra step of creating a new one and migrating data. #3: Athena for querying: Athena is a serverless solution ideal for querying large datasets stored in S3, aligning with the requirement for a serverless architecture.
  4. ln2718 👍 2 Answered C
    Chat AI - Answer C - Configure CRR on the existing S3 bucket with SSE-S3 and use Amazon Athena to query the data. Serverless SQL: Athena is fully serverless and queries data directly in S3. Encryption at rest: SSE-S3 (S3-managed keys) satisfies encryption with zero KMS key management. Cross-Region Replication: CRR works seamlessly with SSE-S3. Least overhead: No new bucket, no data reload/migration, no KMS key creation/policies, and no databases to manage (unlike RDS).
  5. dce7e4b 👍 2 Answered A
    I would go on option A. Concidering this article: https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-config-for-kms-objects.html If we just activate the replication on the existing bucket, the unencrypted data will by replicate unencrypted. If there was an option for creating a new bucket with crr, sse-s3 AND Athena I would have chosen this one. But the nearest solution is Wright en with rds instead of Athena. So go for A
  6. Ell89 👍 2 Answered A
    A is correct. everyone. voting for c i think isnt paying attention to the part where you need the data replicated to a different region. how are you meant to replicate it without a new bucket? everyone saying use the existing bucket.... urm what? how can you replicate into the same bucket thats in the same region and expect it to be in a different region? clearly A.
  7. tch 👍 2 Answered C
    we don't need to create a policy specifically for Amazon S3-managed keys (SSE-S3) to encrypt objects in your S3 bucket... should be more easy and LEAST operational overhead
  8. JA2018 👍 2
    For Option A: While using KMS multi-region keys provides more control, it adds extra management complexity compared to SSE-S3.
  9. trinh_le 👍 2 Answered C
    It’s not require highly sensitive data or complexity gain permission. So it should use sse-s3 is suitable
  10. yangbo 👍 2 Answered C
    The default encryption for S3 is SSE-S3, and cross-region replication can be enabled normally.
  11. JunsK1e 👍 2 Answered C
    C is correct because it needs to replicate to different AWS region
  12. Sushmita42 👍 1 Answered A
    The question says "data must be encrypted at rest" and "replicated to a different Region". AWS recommends SSE-KMS with multi-Region keys for cross-region replication when you need strong, centralized key management. Option A uses SSE-KMS multi-Region keys, which is the more robust, secure, and future-proof choice. Option C uses SSE-S3, which is simpler but less secure and not ideal for cross-region replication at scale. Also, in the exam, "new S3 bucket" is often a hint that you should avoid messing with existing data and encryption settings — it’s cleaner and more operationally efficient.
  13. 2422182 👍 1 Answered C
    C due to: Athena = Serverless SQL Amazon Athena allows you to run SQL queries directly against data in S3 without managing servers or databases. SSE-S3 = Lowest operational overhead SSE-S3 automatically encrypts objects at rest and requires no key management. CRR = Cross-Region replication S3 Cross-Region Replication automatically replicates objects to another AWS Region.
  14. 46a8566 👍 1 Answered A
    S3 with SSE-KMS multi-Region keys + CRR + Athena meets all requirements with least overhead.
  15. Catlyn 👍 1 Answered C
    corrfect

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Scheduled scaling for a predictable morning EC2 traffic spike

S-grade

Improving RDS Performance with Provisioned IOPS SSD

S-grade

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide